diff --git a/Oqtane.Client/Modules/Admin/Users/Index.razor b/Oqtane.Client/Modules/Admin/Users/Index.razor
index e2465bd2..29a7d9cf 100644
--- a/Oqtane.Client/Modules/Admin/Users/Index.razor
+++ b/Oqtane.Client/Modules/Admin/Users/Index.razor
@@ -160,6 +160,12 @@ else
 							<input id="redirecturl" class="form-control" @bind="@_redirecturl" readonly />
 						</div>
 					</div>
+					<div class="row mb-1 align-items-center">
+						<Label Class="col-sm-3" For="emailclaimtype" HelpText="The Type Name For The Email Address Claim Provided By The OpenID Connect Provider" ResourceKey="EmailClaimType">Email Claim Type:</Label>
+						<div class="col-sm-9">
+							<input id="emailclaimtype" class="form-control" @bind="@_emailclaimtype" />
+						</div>
+					</div>
 					<div class="row mb-1 align-items-center">
 						<Label Class="col-sm-3" For="metadata" HelpText="The Discovery Endpoint For Obtaining Metadata. Only Specify If The OpenID Connect Provider Does Not Use The Standard Approach (ie. /.well-known/openid-configuration)" ResourceKey="Metadata">Metadata Address:</Label>
 						<div class="col-sm-9">
@@ -208,6 +214,7 @@ else
 	private string _clientid;
 	private string _clientsecret;
 	private string _redirecturl;
+	private string _emailclaimtype;
 	private string _metadata;
 	private string _logouturl;
 	private string _allowsitelogin;
@@ -235,6 +242,7 @@ else
 		_clientid = SettingService.GetSetting(settings, "OpenIdConnectOptions:ClientId", "");
 		_clientsecret = SettingService.GetSetting(settings, "OpenIdConnectOptions:ClientSecret", "");
 		_redirecturl = PageState.Uri.Scheme + "://" + PageState.Alias.Name + "/signin-oidc";
+		_emailclaimtype = SettingService.GetSetting(settings, "OpenIdConnectOptions:EmailClaimType", "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress");
 		_metadata = SettingService.GetSetting(settings, "OpenIdConnectOptions:MetadataAddress", "");
 		_logouturl = SettingService.GetSetting(settings, "OpenIdConnectOptions:LogoutUrl", "");
 		_allowsitelogin = SettingService.GetSetting(settings, "AllowSiteLogin", "true");
@@ -320,6 +328,7 @@ else
 			settings = SettingService.SetSetting(settings, "OpenIdConnectOptions:Authority", _authority, true);
 			settings = SettingService.SetSetting(settings, "OpenIdConnectOptions:ClientId", _clientid, true);
 			settings = SettingService.SetSetting(settings, "OpenIdConnectOptions:ClientSecret", _clientsecret, true);
+			settings = SettingService.SetSetting(settings, "OpenIdConnectOptions:EmailClaimType", _emailclaimtype, true);
 			settings = SettingService.SetSetting(settings, "OpenIdConnectOptions:MetadataAddress", _metadata, true);
 			settings = SettingService.SetSetting(settings, "OpenIdConnectOptions:LogoutUrl", _logouturl, true);
 			settings = SettingService.SetSetting(settings, "AllowSiteLogin", _allowsitelogin, false);
diff --git a/Oqtane.Server/Extensions/OqtaneSiteAuthenticationBuilderExtensions.cs b/Oqtane.Server/Extensions/OqtaneSiteAuthenticationBuilderExtensions.cs
index b6a5f38e..a1589bda 100644
--- a/Oqtane.Server/Extensions/OqtaneSiteAuthenticationBuilderExtensions.cs
+++ b/Oqtane.Server/Extensions/OqtaneSiteAuthenticationBuilderExtensions.cs
@@ -82,13 +82,34 @@ namespace Oqtane.Extensions
         private static async Task OnTokenValidated(TokenValidatedContext context)
         {
             var providerKey = context.Principal.FindFirstValue(ClaimTypes.NameIdentifier);
-            var loginProvider = context.HttpContext.GetAlias().SiteSettings["OpenIdConnectOptions:Authority"];
+            var loginProvider = context.HttpContext.GetAlias().SiteSettings.GetValue("OpenIdConnectOptions:Authority", "");
+            var emailClaimType = context.HttpContext.GetAlias().SiteSettings.GetValue("OpenIdConnectOptions:EmailClaimType", "");
+            if (string.IsNullOrEmpty(emailClaimType))
+            {
+                emailClaimType = ClaimTypes.Email;
+            }
             var alias = context.HttpContext.GetAlias();
             var _logger = context.HttpContext.RequestServices.GetRequiredService<ILogManager>();
 
             // custom logic may be needed here to manipulate Principal sent by Provider - use interface similar to IClaimsTransformation
 
-            var email = context.Principal.FindFirstValue(ClaimTypes.Email);
+            var email = context.Principal.FindFirstValue(emailClaimType);
+
+            // validate email claim
+            if (email == null || !email.Contains("@") || !email.Contains("."))
+            {
+                var emailclaimtype = context.Principal.Claims.FirstOrDefault(item => item.Value.Contains("@") && item.Value.Contains("."));
+                if (emailclaimtype != null)
+                {
+                    email = emailclaimtype.Value;
+                    _logger.Log(LogLevel.Information, nameof(OqtaneSiteAuthenticationBuilderExtensions), Enums.LogFunction.Security, "Please Update The Email Claim Type For The OpenID Connect Provider To {EmailClaimType} In Site Settings", emailclaimtype.Type);
+                }
+                else
+                {
+                    email = null;
+                }
+            }
+
             if (email != null)
             {
                 var _identityUserManager = context.HttpContext.RequestServices.GetRequiredService<UserManager<IdentityUser>>();
@@ -170,7 +191,7 @@ namespace Oqtane.Extensions
                         else
                         {
                             // provider keys do not match
-                            _logger.Log(LogLevel.Error, nameof(OqtaneSiteAuthenticationBuilderExtensions), Enums.LogFunction.Security, "OpenId Connect Provider Key Does Not Match For User {Email}", email);
+                            _logger.Log(LogLevel.Error, nameof(OqtaneSiteAuthenticationBuilderExtensions), Enums.LogFunction.Security, "OpenId Connect Provider Key Does Not Match For User {Email}. Login Denied.", email);
                         }
                     }
                     else
@@ -208,9 +229,9 @@ namespace Oqtane.Extensions
                     principal.AddClaim(new Claim("Provider", context.HttpContext.GetAlias().SiteSettings["OpenIdConnectOptions:Authority"]));
                 }
             }
-            else
+            else // no email claim
             {
-                _logger.Log(LogLevel.Information, nameof(OqtaneSiteAuthenticationBuilderExtensions), Enums.LogFunction.Security, "OpenID Connect Provider Did Not Return An Email Claim To Uniquely Identify The User");
+                _logger.Log(LogLevel.Error, nameof(OqtaneSiteAuthenticationBuilderExtensions), Enums.LogFunction.Security, "OpenID Connect Provider Did Not Return An Email Claim To Uniquely Identify The User");
             }
         }