API scopes and roles

Question

Hi,

When I register an application (Web api) and Expose the API (adding scopes).

I see that we can add appRoles in the manifest.

Is there a way to associate roles and scopes? Like to say an Admin role has Read and Write scopes and the Employee role only has the Read scope on this API.

Or this is more on the web api responsibility to have those association somewhere?

Thank you,

Answer 1

Hello @bdiddy . There's no way to associate or control both of them in Azure AD but you can do it in your application. EG: if an user with employee role token contains Admin only scopes then you could deny authorization.

Let us know if this answer was helpful to you. If so, please remember to mark it as the answer so that others in the community with similar questions can more easily find a solution.