Authorization Azure AD b2c

Question

I'm trying to get some, simple, authorization for my api and I can't see the forest because of all the trees. The setup in Azure AD b2c: web: login api: GetStuff

web->sign-in>azure userflow:signinpolicy -(success)-> token = AccessTokenForUser("scope1","scope2"..) call [Authorize(Policy = "scope1")]api.GetStuff with requestheader=token. Works great but this is only Authentication.

I wan't to implement Authorization and the stuff the turns up when I google it seem way over the top.

1. Divide api into several apps with different scopes.
2. Setting up AZ functions and separate user store
3. Get going with Microsoft Graph

I think all of those seem very over the top. I beleive I'm missing something basic but it eludes me. The a basic supported scenario should be:

If I belong to an item I should be able to edit it, ie write otherwise I should only have read.

Answer 1

Please refer below sample documents and it will help how to implement RBAC in B2C using Security Group. Using below sample you can consider attaching the roles to the user object as custom claim.

Reference: https://github.com/azure-ad-b2c/samples/tree/master/policies/relying-party-rbac