Entra ID roles claim missing in Token

I have an app where the Entra ID login is working fine. However, I would like to identify if the user is in a custom role defined on the App Registration.

I have added my user account to the custom role in the Enterprise Application linked to the App Registration.

The App Registration is set up with ID Token checked.

I have my program.cs with the following code:

builder.Services.AddAuthentication(OpenIdConnectDefaults.AuthenticationScheme)
    .AddMicrosoftIdentityWebApp(builder.Configuration.GetSection("AzureAd"));

builder.Services.Configure<OpenIdConnectOptions>(OpenIdConnectDefaults.AuthenticationScheme, options =>
{
    options.TokenValidationParameters.RoleClaimType = "roles";
});

Yet when look at the User object, it has all my user information but no claim for roles.

Any idea why?

Claims token screenshot (URL instead of friendly name for roles, TID, etc.)

Solution

To get the Azure AD role claims in ID token, check the below:

Create App roles in Azure AD Application:

enter image description here

In Enterprise Application, I added the role for a user:

enter image description here

Now, I generated tokens via Postman using below parameters:

https://login.microsoftonline.com/TenantID/oauth2/v2.0/token

client_id:ClientID
scope:ClientID/.default openid
code:code
redirect_uri:https://jwt.ms
grant_type:authorization_code
client_secret:ClientSecret

enter image description here

When I decoded the ID token, roles are displayed successfully:

enter image description here

The role claims will also be displayed in access token:

enter image description here

Now, I tried to sign-in with the user who is not assigned any roles in the application and the role claims did not display in the ID token:

enter image description here

To get Azure AD role claims using ASP.NET Core web app, refer this GitHub blog by aremo-ms.

In your Startup.cs file modify the code like below:


public void ConfigureServices(IServiceCollection services)
{
                       JwtSecurityTokenHandler.DefaultMapInboundClaims = false;
           services.Configure<OpenIdConnectOptions>(OpenIdConnectDefaults.AuthenticationScheme, options =>
            {
                                options.TokenValidationParameters.RoleClaimType = "roles";
            });

                   services.AddAuthorization(options => 
            {
                options.AddPolicy(AuthorizationPolicies.AssignmentToUserReaderRoleRequired, policy => policy.RequireRole(AppRole.UserReaders));
                options.AddPolicy(AuthorizationPolicies.AssignmentToDirectoryViewerRoleRequired, policy => policy.RequireRole(AppRole.DirectoryViewers));
            });
            }

// In code..(Controllers & elsewhere)
[Authorize(Policy = AuthorizationPolicies.AssignmentToDirectoryViewerRoleRequired)]
// or
User.IsInRole("UserReaders"); // In methods

Reference:

Add app roles and get them from a token - Microsoft Entra