Azure Active Directory - how to map User/Group/App Registrations for JWT generation

Question

I have an Azure Function App (API) linked to an App Registration in Azure Active Directory (AAD), that exposes some custom Roles via the Manifest.

A client App Registration in AAD can add the API and select from its custom Roles as permissions. This allows the client app to call AAD to obtain a JWT that includes these custom Roles, which can then be checked by the downstream Function App during JWT validation.

• I would like the client App Registration to also include other API's custom Roles as part of a company's 'Product Group' (eg. Product Group may be Sales, Service, Finance etc.).

• I want to create AAD Users representing each B2B consumer system, and link them to a Group that aligns to a company 'Product Group'.

Therefore, a User (B2B consumer system) should be able to request a JWT that includes custom Roles for all API's in the Product Group. I need the JWT to include information of the consumer system, as it needs to be available to the downstream Function App.

What's the best way to achieve this?

Answer 1

The best we could come up with is to create App Registrations with custom Roles in the manifest to represent each Product Group. These App Registrations are completely independent of any specific Function App (API) implementation.

Then we have a client App Registration for each B2B consumer system, that imports the required custom Roles from its parent Product Group App Registration.

The downstream Function Apps (API's) then perform processing based on the Roles extracted from the JWT.