Azure AD 访问令牌不包含组声明

Question

I'm using curl command to get access token, i'm able to get access token using curl command with client credentials.

curl -X POST -H 'Content-Type: application/x-www-form-urlencoded' -d 'grant_type=client_credentials&client_id={client_id}&client_secret={secret}' https://login.microsoftonline.com/{tentant_id}/oauth2/v2.0/token

But the Access token does not contain group claims.

How to get groups in the access token..? any help is appreciated

Answer 1

You may refer to this document

If you are exposing a Web API using the Expose an API option, then you can also choose the Group ID option under the Access section.

So, when you add groups claims in Token configuration blade, you need to pick "group id" in "Access"

And you also need to check the manifest file of the azure ad app in azure portal, if the groupMembershipClaims claim has null vaule, you may set it to All ,see this section .

If you need to add groups for your azure ad app, go to azure ad -> Enterprise Applications -> find your app -> users and groups

Then you need to "expose an api", follow this document , then you need to add the api permission in your azure ad application which used to generate access token.

The screenshot below is an access token generated by ropc flow. But actually, I test with client credential flow, I can't get groups claim. In my opinion, this is because client credential flow is not related to a user, even user groups.