azure groups for authorisation / authorization

Question

How can I use Azure Ad Groups to grant access to a MVC application in Azure AD? For example is there somewhere in the App registration where I can state that an authenticated user ( ******@MyDomain.com) needs to be a member of AAD group 'X' in order to access the application, and membership of AAD group 'Y' is needed to have the custom 'MyAppEditor' role.

I have seen tutorial based on local administration of roles, but I'd like if possible to add the claims ( & have the admin ) via AAD

Answer 1

Hi @Richard Scannell

Thank you for reaching out to the community forum!

For your query. I understand that you would like to add users and group to access the application and membership of another Azure AD group is needed to have a custom role.

To control the access of application, you can assign users and groups to the application for more information please refer Manage users and groups assignment to an application.

Coming to custom role for group membership, you can Create and assign a custom role to your required users or groups by this way the group members will have the custom role get assigned.

The other side about to add the claims. Yes, it is possible to add claims via Entra ID (AAD) to achieve this.

• Sign in to the Microsoft Entra admin center
• Browse to Identity > Applications > App registrations.
• Choose the application for which you want to configure optional claims.
• Under Manage, select Token configuration.
• Select Add optional claim.
• Select the token type you want to configure.
• Select the optional claims to add.
• Select Add.

For information please refer: Configure optional claims.

Reference: https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/custom-enterprise-apps

https://stackoverflow.com/questions/48272345/application-access-permission-via-app-registrations-users-and-groups-azure-act

https://stackoverflow.com/questions/77946716/grant-access-to-a-specific-group-in-azure-ad-for-an-application-is-not-working

Thanks,
Akhilesh.

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.