Microsoft Entra ID Oauth2 Client Credentials and Group claims

I created a Enterprise App on Azure portal, assigned a group called TEST_GPR.

Now I'm trying to generate a access_token using client_credentials flow:

curl --location 'https://login.microsoftonline.com/{tenant-id}/oauth2/v2.0/token' \
--header 'Content-Type: application/x-www-form-urlencoded' \
--data-urlencode 'client_id=xxxx' \
--data-urlencode 'client_secret=xxx' \
--data-urlencode 'grant_type=client_credentials' \
--data-urlencode 'scope=https://graph.microsoft.com/.default'

This returns the jwt token but without any group or role claim. I enabled groups claims but no success:

Note that: Group Claims can be configured only in user context flow. Client credential flow is nonuser interactive flow hence group claims are not displayed in the access token generated by the Client credential flow.

• Client credential flow does not allow to customize access token by configuring custom claims.
• Only Claims like displayname, objectid and tags can only be used in client credential flow.

To display group claims in access token, you need to switch to user interactive flow like below:

Generated access token using Authorization code flow:

https://login.microsoftonline.com/TenantID/oauth2/v2.0/token

client_id:ClientID
scope:api://xxx/groups.read
grant_type:authorization_code
redirect_uri:https://jwt.ms
client_secret:ClientSecret
code:code

Now the group claim is successfully displayed in access token:

Reference:

jwt - Does Azure's EntraID support dynamic custom claims? - Stack Overflow by me