►
From YouTube: Microsoft Identity Platform community call – June 2023
Description
Microsoft Identity Platform Community call delivered on June 15th.
Latest changes in token customization that include token claims issuance policy with editor (new) and added custom claims providers. Review optional claims, customizing ID and Access Tokens, adding additional claims, token overage claims, configure a group claim and groups coverage claims. Steps to process groups claim and app roles assigned to users. Should you really be customizing your tokens? Using Microsoft Graph instead of tokens, custom claim providers for data you cannot get from Graph using custom authentication extensions and single sign on – attributes and claims.
Presenter - Kyle Marsh, Principal Product Manager (Microsoft). The host of this call was Nandeesh Swami (Microsoft). Q&A takes place in chat and throughout call.
Agenda items
00:00 – Intro - Nandeesh Swami (Microsoft)
01:16 – Topic – Token Customization – Kyle Marsh | @kylemar, Principal Product Manager (Microsoft)
56:22 – Closing
Learn more
• Twitter https://twitter.com/microsoft365dev and @azuread
• See the full blog post for this call in the Microsoft 365 platform community blog - https://aka.ms/community/blog
• Microsoft 365 Unified Sample gallery - https://aka.ms/community/samples
• Microsoft 365 Platform Community in YouTube - https://aka.ms/community/videos
• Microsoft 365 Platform Community - http://aka.ms/community/home
• Mark your calendar for next call on July 20th at 9:00am PT. Download the recurrent invite for this call | https://aka.ms/IDDevCommunityCalendar
A
B
Thanks
a
lot
folks,
we
had
you
know
after
like
a
month
we're
back,
we
started
our
series.
You
can
expect
a
lot
of
calls
coming
in
the
upcoming
months.
We
will
be
starting
with
token
customization
this
month,
some
ground
rules.
We
have
a
survey
which
we
will
be
sharing
in
the
midst
of
the
caller.
At
the
end
of
the
call,
we
would
love
to
get
your
feedback.
We
use
that
to
schedule
your
calls.
B
We
have
a
YouTube
channel
which
you
can
access
at
AKA,
dot,
Ms,
slash,
n365,
PNP,
slash
videos,
and
then
you
can
follow
me
on
LinkedIn
at
Dundee
Swami,
and
then
our
Twitter
handles
Microsoft,
365
and
Azure
ID.
Please
follow
them
to
get
updates
on
your
product
as
well,
as
you
know,
any
calls
or
events
that
we'll
be
doing
in
Future
Let's
Stay
respectful.
This
is
not
a
support
channel.
B
So
if
you
have
any
questions,
you
know
feel
free
to
raise
your
hand
or
you
know,
put
it
in
the
chat
window,
we'll
be
happy
to
take
it.
The
next
call
is
going
to
be
on
July
28th,
which
is
going
to
be
the
third
Thursday
of
the
month.
All
right
perfect,
we
are
recording
this
call,
so
in
case
you
would
want
to
be
not
part
of
the
call
feel
free
to
drop,
but
then
we
will
be
recording
and
posting
this
on
our
YouTube
channel.
A
So
we're
gonna
revisit
the
the
topic
of
token
customization,
so
just
a
title
there.
It's
actually
something.
We've
talked
about
a
few
times,
but
the
nice
thing
here
is
that
we
have
been
adding
new
capabilities
and
new
functionality
here.
So
I
did
want
to
to
re-examine
or
take
another
look
at
our
token
customization
capabilities.
A
The
first
question,
of
course,
is
why
would
I
want
to
customize
a
token?
The
token
is
the
primary
transaction
a
developer
has
with
Azure
ad.
Your
application
asks
for
a
token
to
find
out
who
the
user
is
an
ID
token
in
that
case,
or
you
might
want
to
call
an
API,
that's
protected
by
Azure
ID,
and
you
need
that
authorization,
in
which
case
you
need
an
access
token
to
be
authorized
to
access
a
resource.
Api.
A
Another
option,
of
course,
is
there
are
occasions
where
there's
information
you
want
to
know
that,
but
you
don't
want
to
go
ahead
and
learn
whatever
particular
system.
The
identity
provider
has
to
get
gather
that
information.
So,
for
example,
if
I'm
an
isv
and
I'm
doing
a
purely
standards
based
approach
for
my
implementation
on
oauth2
or
open
ID
connect.
I
might
want
to
say
well,
I
need
some
information
about
the
user.
In
the
token,
so
I
don't
have
to
go
off
and
learn
how
else
I
might
find
that
information.
A
A
This
allows
us
to
have
very
custom
information,
that's
targeted
to
a
specific
tenant.
We
have
a
similar
capability
here
in
the
token
customization
as
well,
so
I
can
use
optional
claims
on
the
application
registration
if
I
want
to
make
sure
to
have
something
that
would
work,
no
matter
which
tenant
I'm
running
in
or
in
generically
work
across
all
of
all
of
the
different
places
my
app
might
run
because
optional
claims
are
are
tied
to
the
application
registration.
A
A
Well,
that's
not
a
standard
property
that
we
have
in
Azure
ad,
but
you
could
create
such
a
thing
with
a
token
issuance
policy
saying
well,
I
want
to
have
a
claim
named
division
name
and
the
data
is
going
to
come
from
extension
attribute,
7
or
6
or
whatever
it
might
be
in
my
tenant.
Obviously,
each
tenant
would
have
their
own
way
of
the
filling
or
or
figuring
out
what
that
division
name
where
it
would
come
from.
A
So
the
those
are
very
tenant,
specific
token
customizations,
and
we
do
that
through
our
token
issuance
policy.
One
really
nice
thing
coming,
that's
just
entering
our
preview
now
is
through
a
claims
issuance
policy.
I
can
configure
a
custom
claim
provider,
so
this
is
an
ability
to
reach
out
outside
of
azure
ad
in
order
to
get
values
you
want
to
see
in
your
token
as
claims.
A
A
Now
there
are
two
different
types
of
tokens
and
you
can
customize
either
one.
In
fact,
there
are
no
different
rules
for
customizing,
an
access
token
versus
an
ID
token,
all
of
the
capabilities
and
all
of
the
functionality
work
in
either
case
for
either
token.
But
you
need
to
be
aware
of
which
token
you
should
be
customizing,
based
on
the
scenario
of
your
application.
Id
tokens
are
issued
to
client
applications
so
that
they
can
identify
the
user
and
maybe
learn
some
additional
attributes
about
the
user.
A
They're
not
used
to
call
apis
they're
only
targeted
at
that
one
client
application
and
if
I
am
a
client
application
that
is
not
providing
a
resource.
In
other
words,
I
don't
provide
an
API,
then
I
would
customize
the
ID
token,
because
that's
the
token
I
I
own,
the
audience
claim
will
be
my
client
ID.
So
that's
my
token.
If
I
provide
an
API,
so
I've
implemented
a
resource
API
of
some
description
and
therefore
I'm,
my
API
is
going
to
get
access
tokens
from
those
client
applications.
A
A
What
doesn't
work
is
for
a
client
application
to
customize
an
access
token.
Yes,
client
applications
are
issued
access
tokens
that
they
then
pass
on
to
the
the
calling
application.
But
you
cannot
customize
that
that
token
belongs
to
the
implementing
resource
API,
so
they
can
customize
their
token,
but
you
can't
customize
a
token
simply
because
it's
going
to
pass
through
your
application.
A
So
if
you're,
a
client
application
make
sure
you're
customizing
ID
tokens,
if
you
are
an
API,
make
sure
you're
you're
customizing
your
access
tokens
all
right.
So,
let's
start
with
something
simple
and
we're
going
to
add.
Some
optional
claims
that's
kind
of
our
easiest
Point
here.
So
let
me
sign
out
of
this.
Actually,
let's
go
back
here.
I
want
to
sign
back
in
here
and
I
deliberately
assigning
out
of
this
user.
A
A
So
these
are
the
standard
claims
that
you
find
in
an
ID
token,
that
has
that
no
customizations.
So
this
is
the
you
know.
Like
my
audience
claim,
this
is
going
to
be
my
application.
Client
ID
I
have
the
issuer,
which
is
always
a
an
Azure
ad
in
this
case,
I
have
the
time
frames
in
which
this
token
is
valid.
I
have
my
Optics
ID,
which
is
a
great
thing
to
key
data
off
of.
A
If
I'm
going
to
associate
data
with
this
particular
user,
if
I
want
to
be
very
privacy,
focused
I
would
use
the
subject
claim
instead
to
associate
data
with
this
user,
because
the
subject
claim
can't
be
used
to
go
back
and
find
out
that
this
data
I've
stored
is
actually
data
associated
with
Alex
here,
because
the
subject
claim
is
a
one-way
key
and
then,
of
course,
my
tenant
ID.
So
this
is
the
standard
set
of
claims.
Let's
go
ahead
and
sign
out
of
here
and
we'll
go
over
to
our
application.
Registration.
A
For
this
little
app
and
I'm
going
to
go
here
to
token
configuration-
and
this
is
where
I
can
as
a
developer-
ask
for
different
claims
in
my
token,
and
it
would
work
no
matter
where
the
application
is
running,
it's
not
tenant
specific
information.
So
the
first
thing
is:
let's
go
to
optional
claims.
These
are
kind
of
the
easiest
one
to
to
add
again,
I
have
to
think
am
I
an
application
or
am
I
an
API.
A
If
I'm
an
application
like
this,
one
is
I'm
going
to
customize
my
ID
token,
if
I
was
an
API
I'd
do
my
access
token,
and
now
what
we've
gone
through
here
is
I
can
simply
just
pick
what
claims
do
I
want
to
see.
In
my
token,
maybe
I
want
to
find
out
this
user's
IP
address
or
really
a
really
handy.
Customization
here
is
to
get
the
login
hint.
A
The
login
hint
is
great
too,
because
if
I
do
want
to
come
back
and
log
in
again
or
if
I
want
to
log
the
user
out
or
if
I
want
to,
you
know
share
with
another
application,
that's
going
to
sign
in
hey,
which
user
should
you
be
signing
in
on
behalf
of
this
login
hint
is
a
great
thing
to
use.
I
can
find
out
things
like
when
does
the
password
expire?
Where
would
the
user
go
to
update
their
password?
A
Etc
and
I
can
even
do
something
like
say,
find
out
some
information
from
whether
this
user
is
coming
from
on
premise
and
what
their
security
identifier
is.
Okay,
so
it's
really
just
a
pickum
I
can
pick
any
of
these
things
and
and
customize
the
token
that
way,
so
now,
I
would
expect
these
claims.
In
my
token,
let's
do
another
thing,
while
we're
here
we
have
a
very
special
format.
Just
for
adding
group
claims.
A
Group
claims
are
often
looked
at
as
hey
I
want
to
do
an
authorization
decision
and
I
want
to
base
it
based
on
the
users
the
what
groups
the
user
is
a
member
of.
So,
let's
start
with
our
our
default
one:
here
we
have
security
groups.
This
is
everything
except
the
ones.
The
groups
that
office
uses.
So
if
I
have
a
regular
Security
Group
I
can
ask
for
those.
A
I
can
also
ask
for
the
directory
roles
which
we
treat
as
groups,
but
really
there
are
roles
that
this
user
is
assigned
in
Azure
ID,
so,
for
example,
I
might
be
attended,
admin
or
I
might
be
a
user
administrator
or
a
groups
administrator.
If
I
wanted
to
only
expose
capabilities
to
people
who
are
group,
administrators
I
would
ask
for
the
directory
roles
to
be.
A
In
my
token,
I
could
also
ask
for
all
groups,
which
will
say
the
security
groups,
the
directory
rules,
as
well
as
any
office
space
groups,
distribution
lists,
for
example,
so
I'm
in
a
I'm
in
a
a
group
in
teams
or
I
I'm
on
an
email,
email
Alias
list.
If
I
want
any
possible
group
that
this
user
is
a
member
of-
and
this
will
include
by
the
way,
nested
groups,
so
any
groups-
I'm
a
member
of
and
any
nested
groups
that
I'm
a
member
of
will
be
part
of
of
that
token.
A
Now
so
that's
a
standard
set
of
easy
ways.
If
you
will
oh
I,
should
mention
when
I
do
my
groups,
I
do
have
the
opportunity
and
I
can
do
this
here
to
ask
for
something
other
than
the
group
ID
in
Azure
ID.
Only
the
group
ID
is
actually
unique.
So
if
you're
really
going
to
write
some
code-
and
you
need
a
unique
identifier
for
the
group-
you
have
to
use
the
group
ID,
especially
if
it's
a
cloud-based
group.
A
However,
maybe
your
groups
are
coming
from
on-premise
and
you've
got
some
code
already
that's
looking
at
for
a
group
name,
you
can
ask
for
the
group
name
to
be
from
an
on-premise
group
to
be
showing
up
as
a
name
in
various
formats.
In
fact
I.
If
I
take
one
of
those
names,
I
can
even
have
it
show
up
as
the
roles
claim.
All
of
this
is
to
make
it
a
little
easier
to
Port
on-premise
applications
to
the
cloud.
A
So
let's
go
ahead
here
and
we
won't
do
any
changes
here.
Let's
go
back
to
our
application
and
sign
in
again
and
for
those
folks
who
are
asking.
This
is
just
my
little
best
practices.
Zappa
oh
I,
see
thanks
thank
bugs
in
for
dropping
the
link
to
it.
So
you
guys
can
can
use
this
if
you'd
like
as
well
so
I'll
go
ahead
and
sign
Alex
back
in
again
and
now
I
get
a
customized
ID
token.
A
A
That's
our
directory
roles
that
have
been
assigned
to
Alex
and
I
can
see,
because
the
the
nature
of
this
particular
ID
that
Alex
is
just
a
regular
user
in
this
tenant
he's
not
a.
He
has
no
admin
privileges
or
no
special
rules
assigned
to
him
at
all
and
I
can
make
my
decisions
based
on
that.
So
that's
a
pretty
easy
way
to
just
get
group
the
additional
information
into
the
token
now.
A
So
the
problem
is,
we
can't
fit
all
of
the
groups
that
Alex
is
a
member
of,
especially
if
you
pick
that
all
groups
choice
that
we
did
before
into
this
token,
because
it
would
just
get
too
big
right
and
and
we
we
have
to
live
within
the
boundaries
of,
for
example,
implicit
flow
and
putting
it
on
a
redirect,
URL
and
so
on.
So
we
limit
how
many
groups
you
can
find
in
this
token,
two
in
the
case
of
a
of
a
jot
token,
like
this
one
200..
A
So
if
Alex
is
a
member
of
201
groups
or
more,
you
won't
get
any
groups
in
the
token
you'll
get
what
we
call
the
group
overage
claim
instead
and
you'll
be
expected.
If
you
actually
want
to
know
what
groups
Alex
is
a
member
of
to
go
and
call
Microsoft
graph
to
figure
it
out,
because
we
can't
put
too
many
groups
and
that
too
many
is
201
groups
into
a
token.
Now,
if
you've
implemented
an
application,
that's
using
implicit
flow
and
getting
your
ID
token
that
way,
the
limit
is
even
smaller,
it's
six!
A
So
if
Alex
is
a
member
of
seven
groups
and
clearly
he's
a
member
of
more
than
seven
here,
I
won't
get
the
groups
in
the
token
again
again,
I'll
get
a
token
overage
claim
instead,
so
why
groups
are
pretty
easy
to
add.
To
my
token,
they
can
be
a
little
bit
less
useful
as
a
developer,
because
well
I'm,
stuck
with
only
I,
won't
know
if
I
actually
can
get
all
of
this
user's
groups
in
or
not.
A
Does
that
sign
out
of
the
case
here
and
go
back
to
our
our
configuration
and
let's
delete
the
group's
claim
here
and
so
one
option
to
try
to
avoid
getting
into
a
group
overage
claim
situation.
So
I'll
go
back
to
my
adding
the
groups
I'm
going
to.
Instead
of
picking
one
of
these
I'm
going
to
pick
groups
assigned
to
the
application.
I
can
still
pick
something
like
directory
roles
here
as
well.
A
What
this
is
going
to
do
is
instead
of
saying
well,
Alex
is
a
member
of
thousand
groups,
so
you
can't
know
them
we're
only
going
to
put
the
group
claim.
In
the
token
if
the
group
is
assigned
to
the
application,
so
let's
go
ahead
and
add
that
that
configuration
for
us
so
now
we're
going
to
get
groups,
but
only
groups
assigned
to
the
application.
A
So
let's
go
over
to
an
IT
admin
here
and
go
to
our
Enterprise
apps.
Our
applications
played-
and
here
are
Enterprise
apps
and
here
we'll
find
the
same
application.
Hopefully
there
we
go
so
this
is
the
Enterprise
app
or
service
principle.
This
is
where
it
folks
go
to
go
to
manage
how
this
application
works
in
this
particular
tenant.
Now
this
is,
of
course,
where
an
itpro
would
say.
Well,
here
are
the
users
or
groups
that
I
want
to
assign
to
this
application.
A
So,
for
example,
I
could
come
here
as
an
IT,
Pro
and
I
could
say
that
assignment
is
required.
That's
not
working
so
here
I
have
an
option
of
turning
this
on
assigned
assignment
required
and
if
I
do
it
means
nobody
gets
to
use
this
app
unless
they're
actually
pre-assigned
to
the
application.
So
it's
not
really
token
customization
I
don't
have
to
talk
to
the
developer
about
this.
If
I
say
I'm
assigning
this
I
require
assignment,
and
only
these
five
individuals
get
to
use
this
app
the
when
the
application
goes
to
authenticate
a
user.
A
A
So
now
we've
assigned
a
couple
of
groups
and
if
either
of
these,
if
if
the
user
is
a
member
of
either
of
these
groups,
their
group
that
their
their
ID
will
show
up
or
the
group
ID
will
show
up
as
a
claim.
In
our
token,
so,
let's
see
if
we
can
do
that.
This
sometimes
takes
a
moment
or
two
for
thinking,
because
as
we
as
we
do
a
replication.
But
let's
give
this
a
try.
We
might
have
to
sign
in
again.
A
So
let's
go
ahead
and
sign
in
as
Alex
and
last
time
we
had
so
the
our
first
Optima
customization
that,
where
we
took
out
all
the
groups
is
clearly
working
because
it's
the
the
group
claims
are
all
gone
here
and
sign
out
again
and
try
again
and
again.
This
is
a
replication.
It
can
take
a
few
minutes
before
groups
show
up,
which
is
what's
happening
here
so
I'm
going
to
let's,
let's
wait
for
a
second
and
I'll
come
back
and
oh
actually,
I
should
check
come
to.
A
A
A
A
A
So
I
still
may
get
a
group
overage
claim,
but
I've
lowered
the
probability
quite
a
bit.
The
other
thing
to
note
here
is
that
Alex
has
to
be
a
member
of
the
group
at
a
top
level.
Nested
groups
are
not
supported,
so
if
I
wanted
to
make
sure
that
this
particular
group
claim
was
here,
Alex
can't
be
here
because
he's
a
member
of
a
nested
group.
He
has
to
be
here
at
the
top
level
so
that
can
impact
whether
or
not
the
the
check
you're
doing
based
on
group
membership
is
really
working
or
not.
A
A
The
token
will
will
see
what
the
what
the
width
claim
would
have
been
at
the
time
that
that
token,
that
you,
the
token
was
issued
to
the
application,
can
I
speak
to
how
a
feature
flag
would
be
incorporated
into
a
token.
I
will
be
getting
to
what
you
might
be
able
to
do
in
that
space
a
little
later,
so,
let's
hold
off
for
a
minute
what
rights
are
required
to
add,
assigned
users
group
to
an
application
programmatically
as
far
as
the
the
rights
that
would
be.
A
A
Registration
either
programmatically
or
in
the
UI
that
can
be
turned
off
and
users
are
not
allowed
to
do
application
registrations,
in
which
case
you
would
need
to
be
an
owner
of
the
app
or
you
could
have
the
application
admin,
the
Cloud,
app
admin
or
the
app
developer
roles
that
would
allow
you
to
manipulate
application
registrations,
programmatically
or
online.
It
doesn't
really
make
any
difference.
It's
all
the
same
with
respect
to
that.
Okay.
So,
let's
go
back
to
the
slides
for
a
minute.
Any
other
questions.
A
Why
I'm
here
we'll
see
how
we're
doing
against
getting
the
slides?
Okay,
we
did
that
again.
Group
overage
claims
right,
so
these
are
pretty
severe
limits,
they're
quite
small,
especially
when
you
think
about
using
a
hybrid,
the
the
implicit
flow
which
will
impact
say,
an
application
built
on
asp.net
core
because
they
use
hybrid
by
default.
So
if
you
are
looking
at
that
that
scenario,
this
is
a
problem.
A
The
group
overage
claim
is
a
bit
of
a
problem
here,
so
let's
go
and
take
a
look
at
the
the
what
the
group
overage
claim
looks
like
so
here
you
can
see
when
I
look
at
the
token
and
I
look
at
the
claims.
In
the
token
I
can
see
that
the
the
group's
claim
is
not
here
right.
There
is
no
groups
claim
here
so
instead
as
a
developer,
I
I'd
have
to
look
and
say
well,
I'm,
looking
for
groups
claim
it's
not
here.
A
Instead,
my
code
has
to
go
look
for
underscore
claim,
underscore
names
claim
and
in
in
that
claim.
I
have
to
find
the
groups
entry
and,
if
that's
there,
I
now
know
that
this
token
has
found
a
group
overage
claim.
So
here
you
can
see
that
we
also
provide
this
underscore
claim
underscore
sources
of
endpoint.
This
is
the
Microsoft
graph
that
should
be
the
Microsoft
graph
endpoint.
That
I
would
call
in
order
to
actually
go
ahead
and
find
out
the
group
membership.
A
Fortunately,
this
is
not
a
Microsoft
graph
endpoint.
It's
an
Azure
active
directory
graph.
Endpoint
and
you
can't
use
it
anymore-
we
have
15
days
left.
So
that's
we
wouldn't
don't
actually
want
you
to
use
this,
but
really
once
you
know
that
it's
a
group
overage
claim
you
already
know
what
the
query
you
need
to
call
to
Microsoft
graph
is
so
the
while
it
is
here.
It's
not
a
particularly
useful
bit
of
information,
but
I
do
need
to
go
ahead
and
and
make
that
check
for
the
group
leverage
claim.
A
So
if
I
have
implicit
flow,
it's
a
different
format,
it's
not
an
underscore
claim,
underscore
names
claim
it's
actually
a
has
groups
claim.
So
if
there's
a
claim,
there's
no
group's
claim,
but
instead
there's
a
has
groups
claim
with
a
value
of
true,
then
you
can
then
go
ahead
and
assume
that
you
have
to
call
Microsoft
graph,
and
in
this
case
we
don't
give
you
the
query.
You
have
to
know
the
query
ahead
of
time.
A
A
Let's
see
what
what
what
token
is
required
to
make
the
call
to
group
called
graph.
The
permission
you
need,
in
your
token,
is
simply
user.read,
so
I
can
find
out
what
groups
the
user
is
a
member
of
just
with
user.read
and
we're
going
to
take
a
look
at
that
in
just
a
second.
Is
the
ID
token
sufficient?
Well,
the
ID
token
will,
if
you're
looking
to
find
out
which
groups
you
the
user
is
in
a
claim.
Oh
I,
see
if
you
have
an
ID
token,
and
then
you
need
to
call
Microsoft
graph.
A
No,
you
can't
call
Microsoft
graph
with
an
ID
token.
You
have
to
ask
for
user.read
and
get
an
access
token
as
well.
So
if
you
are
going
to
use
groups
in
a
claim
and
we
we
need
you
to
fall
back
to
Microsoft
graph
to
make
that
so
you're
going
to
need
user.read
in
order
to
make
that
call,
you
can't
use
an
ID
token
to
call
Microsoft
graph
okay.
So
what
do
you
have
to
do?
A
A
The
call
I
would
use
to
replicate
the
give
me
all
groups
that
this
user
is
a
member
of,
and
that
would
include
nested
groups
as
well,
and
this
can
be
done
with
a
user.read
permission,
but
it
does
require
an
access
token
can't
make
this
call
with
an
ID
token
and
and
if
that's
not
the
case,
I
can
find
out.
If
there's
a
groups
claim
now.
If
there
is
no
group
under
there's,
no
groups
claim
and
there's
no
underscore
claim
underscore
names
claim
and
there's
no
hazards
claim.
A
A
Okay,
so
one
way
to
avoid
another
way
to
avoid
this,
we
looked
at
one
way,
which
is
to
go
ahead
and
use
groups
that
are
assigned
to
the
application
and
that
that
does
work,
but
it's
still
possible
to
to
get
into
an
overage
situation.
Another
way
to
do
it
is
to
say
well
as
a
developer,
I
don't
really
want
all
the
different
group
information
I
have
some
various
capabilities
in
my
application
and
I
want
to
be
able
to
assign
users
or
groups
to
that
capability.
A
So,
instead
of
dealing
with
groups
and
group,
not
group
IDs,
and
having
to
have
some
kind
of
map
between
the
group
ID
and
my
applications
capability,
instead
I'm
going
to
find
roles
for
my
application.
So
I
go
to
my
application.
Registration
here
and
I
go
to
my
app
roles
and
now
we're
going
to
Define
app
roles
that
can
have
users
or
groups
assigned
to
them.
So
I
don't
have
to
have
this
map.
In
my
code
that
says
this
ID
group
means
approver,
or
this
ID
group
needs
a
admin.
A
A
So
here
we
have
so
this.
This
user
can
now
approve
an
item,
so
great
I've
assigned
effectively
an
elevated
role
here.
Now
here's
a
word
of
caution:
if
you
will
I
cannot
just
create
elevated
roles,
because
if
the
it
pro
comes
back
and
say
you
must
be
assigned
to
use
this
app
when
they
assign
a
user
or
a
group
to
the
app
they
have
to
give
a
role
as
well,
because
I've
defined
roles
here.
So
if
all
I
have
is
approver,
then
the
only
thing
the
it
Pros
can
assign
is.
A
A
And
in
this
case,
let's
go
ahead
and
assign
Alex
this
specifically
assign
Alex
here
so
I'll
edit,
my
assignment
and
now
I
can
see
that
I've
got
these
app
roles
that
have
been
decided
but
been
created
in
my
application.
Registration,
so
I'll
go
ahead
and
specifically
assign
Alex
the
role
of
user,
because
I
don't
Alex
is
just
a
regular
user.
But
for
my
approvers
group
here,
let's
go
ahead
here
and
edit.
A
Okay.
So
let's
go
back
and
sign
in
again.
We
may
look
at
a
replication
time
frame
here,
but
let's
go
ahead
and
sign
in,
and
here
we
can
see
that
we
get
the
the
group
membership
still
there's
Alex's
approver
group
membership
and
Alex
is
assigned
the
role
of
user
just
like
we
assigned
to
him
and
he's
assigned
the
role
of
approver
because
he's
a
member
of
the
approvers
group
and
that
that
group
is
assigned
to
our
approver
role.
A
So,
if
I
sign,
if
I
signed
in
as
as
Kyle
there
wouldn't
be
an
assigned
role
here,
because
the
he
hasn't
been
assigned
any
actual
role
in
that
UI
again
as
a
developer,
you
have
to
be
aware
that
there
may
not
be
a
roles
claim,
even
though
I'm
asking
for
it,
at
which
point
you
would
probably
fall
back
to
whatever
that
Baseline
user
role
you
defined,
would
be
what
someone
would
get
if
they
also
didn't,
have
an
assigned
role
right.
So
you
have
to
be
aware,
when
you're
assigning
making.
A
Can
be
assigned
to
users
in
groups
that
the
role
claim
may
not
be
present,
let's
go
back
to
our
slides
and
let's
see
how
I'm
doing
against
the
slides.
This
is
what
the
token
looks
like
both
with
the
groups
array
and
the
rolls
away.
If
I
looked
at
the
Json
as
I
was
I
was
just
mentioning
that
msol
takes
the
Json
away
for
me.
I
can
just
enumerate
all
the
claims
in
the
token,
and
if
there
are
claims
in
a
in
an
array,
it
just
goes
ahead
and
breaks
them
up
for
me
now.
A
One
question
I
have
about
all
of
this
is:
should
we
really
be
customizing
tokens
at
all
right,
I
kind
of
have
some
problems
with
tokens.
The
first
one
is
a
token
is
valid
until
it
expires,
which
means
I,
don't
get
another
token
until
it
expires.
So
if
I
am
customizing,
my
ID
token
that
I
am
doing
here
well,
the
token
could
be
out
of
date
for
up
to
an
hour
right,
because
my
ID
tokens
are
issued
for
an
hour
lifespan
by
default,
they're
issued
for
whatever
time
we
issue
them
for
by
default.
A
The
tokens
issued
can
be
up
to
28
hours
in
length
because
we
can
revoke
access
to
the
resource
outside
of
the
token
lifespan.
It's
a
great
feature.
It
also
means
the
token
is
going
to
get
a
little
old
right.
So
if
I
am
making
a
decision
well,
you
know
that
that
thing
could
be
stale
the
same
thing
with
groups.
Of
course,
if
I
want
to
do
groups
of
my
token,
it's
almost
impossible
to
really
get
the
answer.
A
I
need
I
have
no
idea
how
many
groups,
a
user,
is
a
member
of
before
they
sign
in
or
even
after,
for
that
member,
so
I
really
have
to
call
Microsoft
graph
to
really
get
an
accurate
representation
of
the
groups.
The
user
is
a
member
of,
and
if
I
did
ask
for
all
the
groups,
the
user
is
a
member
of
most
of
them.
I,
don't
really
care
about
right.
I
I
only
have
a
few
different
roles
in
my
application
and,
of
course,
if
I
do
use
groups.
A
A
Now,
if
I
call
Microsoft
graph,
then
I
don't
have
any
of
these
issues
right.
I
can
simply
call
Microsoft
graph
get
all
of
this
information
instead
and
live
with
that.
Now,
if
I'm
an
ISB
building
in
a
purely
standards-based
way,
sure
maybe
I
still
want
to
do
the
token,
but
if
I'm
building
a
line
of
business
application,
especially
that's
you
know-
that's
built
on
top
of
the
Microsoft
identity
platform,
then
I'm,
probably
better
off
just
using
Microsoft
graph.
Instead,
so
I've
actually
got
this.
So
let's
go
ahead
here
and
we'll
sign
in
Alex
again.
A
Now
notice
I've
actually
got
this
check
mark
on
that
says,
to
evaluate
my
access
with
Microsoft
graph,
so
I
can
see
because
I've
called
Microsoft
graph.
The
the
two
roles-
I
haven't
looked
at
the
definition
here,
but
I've
got
the
two
roles
that
are
here.
That's
just
a
bug:
I
should
usually
have
the
right
name
there
and
I
can
see
the
group
membership
that
Alex
has-
and
here
I
can
see
that
he's
a
member
of
these
particular
groups,
as
well
as
having
these
particular
roles
assigned.
A
Some
indication
of
that
back
here
in
my
ID
token
right
so,
for
example,
here
I've
got
my
wids
claim
and
sure
enough.
Alex
is
a
regular
user.
Now,
in
this
particular
app,
only
group
admins
can
use
this
group's
functionality.
So
since
Alex
is
not
a
group
admin-
and
we
can
see
this
on
our
groups-
tab
right
group
admin
nope-
he
can't
see
he
can't
this
button
is
not
enabled
okay.
Well,
let's
fix
that.
A
Let's
go
over
to
our
to
our
our
tenant
here,
we'll
go
into
Alex
as
a
user,
and
this
is
where
this
responsiveness
to
Pym
really
does
come
into
play
here.
So
let's
go
ahead
and
assign
Alex
the
role
of
group
admin
right,
so
he's
a
group
administrator
and
now
what
I'm
going
to
do
is
I'm
going
to
make
it
an
active
assignment.
It
could
make
it
eligible
and
use
PIM
in
a
more
normal
way.
A
But
let
me
go
ahead
here
and
make
it
a
an
active
one,
just
but
I'm
not
going
to
make
it
permanently
assigned
instead
I'm
going
to
make
it
temporarily
assigned.
So
let's
do
it
for
today
and
I
have
to
have
at
least
a
five
minute
time
frame
here.
So
let's
go
for
nine
50
I
guess
943
yeah,
let's
make
it
9.49
and
now
Alex
will
be
an
admin.
A
So
here
you
can
see
that
the
last
time
it
called
was
at
9
44
n27,
so
we
kind
of
have
to
wait
halfway
through
the
9
45
minute
before
we'll
see
see
that
this
changes,
but
the
the
thing
is,
this
will
change
within
that
time
frame
because
in
the
code,
what
we're
doing
is
we're
doing
a
batch
of
Microsoft
graph
batch
request
to
get
information
about
the
user.
Have
they
signed
out?
Have
there
has
there
they've
been
deleted
or
or
disabled
have
their
have?
A
They
changed
their
password
lately?
Are
they
still
assigned
the
roles?
What
role
have
they
been
assigned
if
they've
been
assigned
and
and
we're
checking
their
group
membership?
So
we
use
this
batch
of
four
requests
to
micro.
We
make
four
requests
to
Microsoft
graph
in
a
batch
and
it
tells
us
all
of
the
info
information
we're
literally
looking
for
so
now.
We
now
that
we're
halfway
through
9
45.
We
see
that
Alex
is
in
fact
a
group
admin.
A
The
functionality
has
been
turned
on
in
my
application
and
if
I
go
back
to
my
ID
tokens,
I
say:
oh
nope
Alex
is
not
a
group.
Admin
Alex
can't
do
this
capability,
but
if
I
use
Microsoft
graph
instead
I'm
up
to
the
moment
with
respect
to
when
I
do
the
check
as
to
whether
or
not
Alex
should
be
allowed
access
to
this
all
important
groups
the
button,
so
we
do
have
a
hand
up
so
in
this
unit,
Eunice,
okay,.
A
A
This
claims
challenge
passed
back,
so
I
get
a
claims,
challenge
parameter
returned
in
the
authorization
header,
and
it's
really
this
code
is
all
you
need
and
I'm
fully
compliant
with
conditional,
continuous
access
evaluation.
So
it's
not
a
big
amount
of
work
on
the
developer
side
to
support
CAE
and
I
strongly
encourage
you
as
long
as
your
application
fits
the
right
profile
like
your
call-in
graph
on
a
regular
basis,
then
continuous
access
evaluation
is
not
a
very
big
amount
of
work
for
the
developer.
A
I
do
need
to
move
on
because
we're
kind
of
I'm
taking
too
much
time
here.
Let
me
move
on
to
the
to
the
next
section:
let's
talk
about
custom
claim
providers,
so
the
nice
thing
is:
this
allows
a
token
to
have
data-
that's
not
from
Azure
ad.
In
other
words,
things
you
can't
get
for
Microsoft
graph.
So
in
this
case
we
actually
do
have
a
real
reason
to
have
a
token,
because
the
information,
in
the
token
is
not
going
to
be
accessible
from
a
call
to
Microsoft
graph.
That
I
could
just
make.
A
So
in
this
case,
we'll
go
through
our
custom
claim
provider.
So
we've
started
a
new
capability
with
an
Azure
ID
itself
called
custom,
authentication
extensions,
and
the
idea
here
is
that
you'll
be
able
to
extend
our
authentication
experiences
or
capabilities
in
this
case.
With
these
custom
extensions.
Now
the
only
custom
extension
we
have
today
is
the
customer
extension
to
add
a
custom
claim,
but
we
have
a
framework
here
where
we
will
be
able
to
add
additional
events
later
so.
A
What
happens
here
is
during
the
authentication
process,
in
this
case,
just
as
a
token
is
being
issued,
we
can
see
if
there's
a
event
listener
registered,
in
other
words,
hey
somebody's
waiting
for
the
token
issuing's
events,
and
if
that's
the
case,
we'll
go
off
and
call
to
your
own
API.
This
could
be
provided
by
an
isv.
It
could
be
provided
by
yourself
as
a
as
a
line
of
business
developers,
but
we're
going
to
call
to
your
API.
A
Your
API
in
this
case
is
going
to
have
the
ability
to
inject
additional
claims
right
from
whatever
system
you
have.
You
can
make
them
up,
it
can
be
hard-coded.
They
could
be
a
database
query
whatever.
It
is
that
you
do
in
order
to
determine
what
the
right
information
that
needs
to
be
in
that
token
is,
and
then
you
send
those
claims
back
to
us
and
we
bundle
them
into
your
token.
A
A
So
yes,
so
well
so
the
request
the
mention
here
is
that
the
one
benefit
is
I
can
see
tokens
that
are
only
relevant
to
my
application.
Absolutely
if
you
look
at
the
code
in
the
best
practices,
app
you'll
see
that
actually,
what
I'm
doing
here
is
and
that's
why
there's
a
little
bit
of
a
loop
here
if
I
look
at
how
I
build
the
access
evaluation
here
notice,
the
first
three
are
just
standard
queries
right,
they're,
just
you
know
what
role
is
this
been
assigned
to
this
service
principle?
A
The
next
one
actually
goes
through
the
list
of
groups
I'm
interested
in
right.
So
what
this
particular
app
will
do
is
if
I
was
interested
in
a
different
group.
I
could
add
it
to
this
list
and
we're
only
checking
this
list
for
membership
right,
so
I
only
care
if
this
particular
user
has
gotten
one
of
these
roles.
The
these
four
roles,
or
as
a
member
of
one
of
these
three
groups
I'm
not
checking
the
entire
T
of
their
their
membership.
A
I'm
only
checking
for
that
one,
these
specific
groups
and
I
do
that
because,
as
I
build
the
query
here
for
this,
this
role,
I
I'm,
building
the
this
particular
check
member
objects
API
in
Microsoft
graph
in
its
body.
It
takes
a
Json
list
of
of
roles.
There
are
groups
that
I'm
looking
for
and
those
are
the
only
ones
that
are
being
checked.
So
yes,
I
can
very
specifically
say-
and
this
is
nice
because
I
don't
have
to
have
my
mapping.
A
A
This
is
where
you'll
find
our
new
claims
issuance
policy
editor
so
here
and
on
my
open,
ID,
Connect,
app
or
of2
app
I
have
my
attributes
and
claims
entry
which
I
can
come
here
and
edit,
and
this
lets
me
Define
within
this,
that
I
want
to
use
a
custom
claims
provider
and
in
this
case
it's
coming
off
the
token
issue,
and
so,
when
a
token
is
being
issued,
I
want
you
to
go
ahead
and
call
this
API.
My
custom
claim
provider
API
and
it's
going
to
make
available
some
additional
claims.
A
So
this
is
how
I
edit
it
in
in
this
is
my
remember.
This
is
very
tenant
specific,
so
it
hangs
off
the
Enterprise
app
or
service
principle
blade
and
in
this
case
I'm
using
this
Editor
to
say,
I
want
to
use
a
custom
claims
provider
which
is
detailed
down
here
and
the
claims
I
want
are
the
custom
rules
so
and
the
date
of
birth.
A
There's
another
couple
of
claims
that
this
provider
has
here
down
here:
a
API
version
and
correlation
ID
not
really
interested
in
those
but
I'd
like
to
see
their
custom
roles
and
and
cut,
and
and
also
the
date
of
birth.
In
fact,
I
can
look
at
these
claims
and
do
additional
manipulation
on
them.
If
I
wanted
to,
I
can
do
Transformations
Etc,
so
I
have
a
full
range
of
capability
of
customizing.
The
claims
in
these
tokens
on
a
customer,
my
customer
or
Enterprise
app
I
Enterprise
app
basis.
A
A
I've
done
everything
except:
oh
sorry,
there.
It
is
custom
claims
on
my
token
test
and
here
I'm,
calling
to
that
API
that
particular
application
is
registered
to
go
as
it's
redirect.
Uri
back
to
jwtwick.ms,
so
I
can
just
look
at
the
token,
and
here
you
can
see
that
this
particular
token
has
some
things
that
are
not.
A
So
this
is
showing
that
I'm
calling
off
into
this
Azure
function
doesn't
have
to
be
an
Azure
function,
but
that's
what
I've
implemented
and
now
I
can
augment
my
token
with
claims
that
don't
come
from
Azure
ID.
So
if
that's
the
need
I
have,
it
can
be
very
powerful
to
use
these
custom
claim
provider
capabilities.
A
We
have
a
question
if,
if
an
app
needs
to
query
graph
on
requests,
this
really
moves
authorization
away
from
access
tokens
to
external
API.
Is
this
Kate
graph?
Is
this
case
graph
correct?
So
there's
a
it
depends
on
what
we're
looking
for
I'm,
not
changing
graphs,
authentic
authorization
I'm
using
graph
to
provide
some
authorization
in
for
my
particular
application.
A
Now
I
could
do
this,
of
course,
in
an
API
if
I
wanted
to,
but
this
is
done
for
my
particular
application
and
I'm
doing
this
authorization
simply
to
have
the
information
that
drives
that
the
token
issuance
queried
in
a
more
timely
manner
right.
So,
for
example,
I
get
an
ID
token.
It's
good
for
an
hour.
A
I'm,
not
I,
shouldn't,
go
back
and
ask
for
another
ID
token
every
15
minutes,
because
at
that
point,
where
you
know
the
token
was
issued
for
an
hour,
the
spec
says
we
should
use
it
for
an
hour.
But
if
I
feel
like
calling
Microsoft
graph
because
I
want
to
check
group
membership
at
the
same
time,
I
can
use
a
batch
to
find
out
hey.
Was
this
user
no
longer
assigned
to
the
app?
So
it
gives
me
an
opportunity
to
move
because
it's
outside
of
the
the
boundary
of
the
standards?
A
If
you
will,
the
standards
are
hey.
We
do
everything
based
on
tokens.
We
have
a
Microsoft
graph
API
that
lets
me
learn
more
about
my
application,
how
it's
configured
and
how
it's
configured
to
run
in
any
particular
tenant.
Therefore,
I
can
use
that
information
to
tighten
up
that
authorization.
It's
not
required,
but
it's
certainly
something
I
can
do
if
I
felt,
like
it
yeah,
so
the
Azure
ad
custom
claim
provider.
A
Here
so
here's
a
nice
overview,
they've
got
as
you
can
see,
videos
and
and
the
the
code
I'm
running
this
custom
claim
provider
I
have
is
straight
out
of
their
their
their
walk
through
here
right.
So
they
got
this
step
step-by-step
set
up
for
you
to
do
a
to
get
a
sample
up
and
running.
That's
all
I
did
I
just
went
through
and
you
can
see
even
the
names
I
think
are
the
same
in
here.
A
So
all
of
the
steps
to
get
a
custom
claim
provider
running
are
right
here
in
this
package
and
it's
a
that
it's
all
I'm
doing
in
this
particular
tenant.
So
that's
the
end
of
the
the
prepared
content.
As
you
can
see,
we've
made
a
bunch
of
changes
recently
in
token
customization
right,
we've
added
that
token,
issuance
policy
with
a
nice
editor,
We've
added
custom
claim
providers
as
well
right,
so
both
of
those
are
big
things
that
you
can
use.
C
I
wanted
to
say
really
quick
I've
done
a
lot
of
this
stuff
just
recently
for
a
client
and
one
thing
that
wasn't
clear
to
me
at
first
that
in
case
it's
not
clear
to
everybody
is
that
if
you
want
to
customize
any
of
the
claims
in
an
access
token,
you
have
to
go
to
that
registration
of
that
of
that
API,
not
the
application.
I
know
you
said
it
at
the
beginning,
but
I
need
to
emphasize
that,
because
that
was
something
I
found
kind
of
tricky.
A
Yeah,
one
of
my
golden
rules
of
tokens
is
never
mess
with
someone
else's
token.
You
don't
own
the
access
token
unless
you
implement
the
API.
If
you
implement
the
API,
go
to
your
you
get
to
customize
that
token.
If
you
don't,
you
don't
get
to
touch
it.
Let's
see
we
have
a
question.
I've
already
implemented
the
process
to
access
our
ldap,
but
I
faced
an
issue
where,
if
the
data
was
not
returned
within
one
or
two
seconds
it
caused
a
problem
with
the
data
provider
was
not
used.
A
A
You
know
if
there's
anything
about
Azure,
ID,
I,
guess
with
respect
to
this
scenario
is
boy
or
are
we
in
a
hurry?
You
know
we
do
billions
and
billions
and
billions
of
authentications
a
day,
and
we
really
just
don't
feel
the
time
to
be
able
to
wait
for
your
response
and
that's
a
very
tricky
thing,
because
hey
if
you're
going
to
take
what
whatever
the
term
too
long
is
then
the
next
thing
you
know
is
hey
we're
going
to
have
a
problem
here,
because
it's
taking
too
long.
A
Unfortunately,
there's
no
real
good
answer
here.
You
unfortunately
just
have
to
be
as
performant
as
possible
and,
of
course,
there's
very
little.
You
can
do
if
it's.
How
long
does
the
query
take
to
get
back
from
my
ldap
caching,
I?
Guess:
I,
don't
know
what
a
good
approach
would
be
there,
but
it
is
going
to
be
an
issue.
We
need
to
be
these
custom.
Claim
providers
need
to
be
very
performant,
Eunice
I,
don't
know
what
you
mean
by
tell
it
to
fsis,
but.
A
D
A
Big
topic
for
us
a
huge
capability.
It
doesn't
come
into
play
in
this
particular
scenario,
because
yeah
verified
credentials
can
can
be
put
in
through
anywhere,
but
it
they
don't
have
any
specific
part
of
this
topic.
But
I'm
sure
nandish
would
like
to
hear
about
anything
you'd
like
to
know
about
verifiable
credentials,
and
maybe
we
can
queue
up
that
part
part
of
the
conversation
up
for
another
yeah.
B
A
The
future
I
would
just
appreciate
you
know,
talk
and
discussion,
a
community
of
in
regard
to
verifiable
credentials
in
web3.
That's
all!
Okay,
thanks
for
the
suggestion.
Okay.
Well
now
we're
overtime,
but
thank
you
everyone.
We
really
appreciate
your
time
enjoy
the
rest
of
your
day,
whatever
that
might
be,
and
thanks
a
lot,
we
really
appreciate
it.
Foreign.