Question

A SaaS company runs a multi-tenant line-of-business web application registered in Microsoft Entra ID. The application needs to authorize users into three permission levels (Reader, Contributor, Administrator) that are specific to this application only. The security team requires that the permission assignment appear directly in the user's access token as a claim, that assignments are managed per-application without polluting the directory with hundreds of security groups, and that a partner ISV consuming the same app can reuse the identical authorization model. Which approach should you recommend?

Accepted Answer

Define app roles in the application registration and assign users/groups to those roles; the roles surface in the token as a roles claim.

Answer

Create three Microsoft Entra security groups and add users to them, then read the groups claim in the token to determine access level.

Answer

Assign Azure RBAC roles scoped to the subscription containing the app and evaluate them at runtime.

Answer

Use Microsoft Entra administrative units to segment users by permission level and enforce access in the application code.