Token Lifetime, Home Realm Discovery & Claims-mapping Policies
The question it answers: Which token lifetime, home realm discovery and claims-mapping policies exist and which apps do they apply to?
These policies change how tokens are issued and where users are sent to sign in, and they have no blade in the Entra portal - so they are easily forgotten. A home realm discovery policy can route sign-ins to a federated IdP; a claims-mapping policy can put claims into tokens that apps trust for authorisation.
At a glance
Section titled “At a glance”| Where in the app | Entra ID › Identity Configuration › Token, HRD & Claims Policies |
| Workload | Entra ID |
| Kind | Findings list · dashboard tile |
| Data | Read from Microsoft 365 when someone first opens it, then kept for the report cache lifetime (Settings > Data & cache, 1 hour unless changed). |
| Licence | None (custom claims mapping for some scenarios needs Entra ID P1). |
| Report id (API and MCP) | entra.configuration.token-policies |
Columns
Section titled “Columns”| Column | Key | Type |
|---|---|---|
| Severity | Severity | Status |
| Policy type | Category | Text |
| Policy | Subject | Link |
| Check | Setting | Text |
| Scope | Value | Text |
| Finding | Finding | Text |
| Apps / definition | Detail | Text |
| Date | When | Date |
| Apps | Number | Number |
A findings list hides columns that no row fills. Severity is Critical, Serious, Warning, OK or Info; rows rated Critical, Serious or Warning need attention (Working with findings).
What it needs
Section titled “What it needs”Licence: None (custom claims mapping for some scenarios needs Entra ID P1).
Application permissions on the IntensiveReports app registration (all permissions):
| Permission | API | What it allows | Note |
|---|---|---|---|
Policy.Read.All | Microsoft Graph | Read your organization’s policies | |
Application.Read.All | Microsoft Graph | Read all applications |
Data sources it reads
GET /v1.0/policies/homeRealmDiscoveryPoliciesGET /v1.0/policies/claimsMappingPoliciesGET /v1.0/policies/tokenLifetimePoliciesGET /v1.0/policies/tokenIssuancePoliciesGET .../{id}/appliesTo
Through the API and MCP
Section titled “Through the API and MCP”GET /ir-api/v1/reports/entra.configuration.token-policies?size=100An AI assistant reads it with the MCP tool get_report and the id entra.configuration.token-policies. The client needs the Read grant for Entra ID. See Using the API.