Extend azure active directory access token claims

Question

I'm currently trying to authorize my api depending on the user group. After enabling the group claim in Azure Active Directory I have realized that the groups claim is not including in the access_token but the id_token.

I'm trying to avoid makings requests to the graph api and I've seen something about azure active directory claims mapping ( https://docs.microsoft.com/en-us/azure/active-directory/active-directory-claims-mapping )

But due to the lack of information and examples I'm not sure of how to deal with this.

Any suggestions on how to get the extra claims into the access token?

Answer 1

You can get group ids in access tokens too.

But the API app manifest must have:

{
  "groupMembershipClaims": "SecurityGroup"
}

Note that this must be in the APIs manifest, not the client app's manifest.

Answer 2

In AAD, when you create an SSO application, you can create custom claims where you can customize the SAML response from AAD to the target application.

See this for more information.