Unable to Configure sub Claim as Email in Azure AD Access Token (App Registration)

Hello Sanket Mahajan

• In Azure AD / Microsoft Entra ID, the sub claim is immutable and cannot be changed or mapped to another attribute (like email). It is an opaque, app‑specific identifier.

https://dotnet.territoriali.olinfo.it/sk-sk/entra/identity-platform/id-token-claims-reference?

Hence try the below:

• Keep sub as the unique identifier.
• Use email, upn, or preferred_username claims (via optional claims) if the target system requires the user’s email.
• Only Azure AD B2C with custom policies allows overriding sub.
• In Azure AD / Microsoft Entra ID, the sub claim is immutable and cannot be changed or mapped to another attribute (like email). It is an opaque, app‑specific identifier.
• Keep sub as the unique identifier.
• Use email, upn, or preferred_username claims (via optional claims) if the target system requires the user’s email.
  • Only Azure AD B2C with custom policies allows overriding sub.

If the resolution was helpful, kindly take a moment to click on and click on Yes for was this answer helpful. And, if you have any further query do let us know.

Azure AD (Microsoft Entra ID) does not support changing the semantics of the sub claim in OAuth2/OIDC tokens. The sub (subject) claim is designed to be a stable, opaque, non-reassignable identifier for the security principal, not a human-readable attribute such as email.

From the token behavior:

• The sub claim is the principal about which the token asserts information and is intended to be immutable and safely usable for authorization decisions.
• By design, it is not meant to be an email address or any other mutable user attribute.

“The Subject (sub) claim – The principal about which the token asserts information, such as the user of an application. This value is immutable and can't be reassigned or reused. It can be used to perform authorization checks safely…”

Because of this design, there is no supported configuration in a standard Microsoft Entra ID app registration (or token compatibility settings) to:

• Override sub to contain the user’s email, or
• Map sub to any other user attribute.

Supported approaches instead are:

• Use sub or oid as the stable identifier for the user, and use other claims (such as email, upn, or custom/optional claims) for the email address.
• If the target system requires email in sub, that system is not aligned with the OIDC/JWT best practices for sub. The recommended pattern is to configure the target system to:
  • Use sub or oid as the unique key, and
  • Use email (or another claim) for the email address.

Microsoft explicitly recommends not using human-readable data (like email) as the primary identifier and instead using sub or oid:

“Your application mustn't use human-readable data to identify a user. You can use extension claims provided by Microsoft, such as the sub and oid claims.”

Therefore:

• It is not possible or supported to configure sub to be the user’s email in Azure AD access tokens.
• The supported approach is to keep sub/oid as the stable identifier and adjust the relying party (Tableau Cloud) configuration or integration logic to use email from a different claim while using sub/oid as the unique ID.

References:

• Configure tokens in Azure Active Directory B2C (b2c-custom-policy)
• ID token claims reference
• Configure and manage optional claims in ID tokens, access tokens, and SAML tokens