Created by Claude - please verify

Token policies - custom HRD, claims-mapping, token-lifetime and token-issuance policies with the apps they apply to.

Required Microsoft Graph permissions

Policy.Read.All Application.Read.All — application permissions, granted to the app registration with admin consent.

Licence: None (custom claims mapping for some scenarios needs Entra ID P1).

Endpoints: GET /v1.0/policies/homeRealmDiscoveryPolicies · GET /v1.0/policies/claimsMappingPolicies · GET /v1.0/policies/tokenLifetimePolicies · GET /v1.0/policies/tokenIssuancePolicies · GET .../{id}/appliesTo

If a permission is missing, this report shows a red load error with the Graph status code — not an empty table.

Token Lifetime, Home Realm Discovery & Claims-mapping Policies

These policies change how tokens are issued and where users are sent to sign in, and they have no blade in the Entra portal - so they are easily forgotten. A home realm discovery policy can route sign-ins to a federated IdP; a claims-mapping policy can put claims into tokens that apps trust for authorisation.