Exam AZ-204 topic 2 question 57 discussion

Correct

Azure Active Directory (Azure AD) supports adding custom roles to an application's manifest, which can then be assigned to users or groups. When a user is authenticated, these roles are included in the token as claims. This approach allows for fine-grained access control within your application based on these role assignments. Moreover, when the application registration is deleted, these roles and corresponding claims automatically cease to exist, fulfilling the requirement that the claims must be removed when the app registration is removed.

E not D because of this condition "The claims must be removed when the app registration is removed."

E not D because of this condition "The claims must be removed when the app registration is removed."

To include custom claims in the user access token from Microsoft Identity for user authorization, you should: E. Add the roles to the appRoles attribute in the app manifest. Explanation: In the Azure AD app manifest, you can define custom roles using the appRoles attribute. These roles can then be assigned to users, and the associated claims will be included in the user's token. Ensure that the appRoles attribute in the app manifest includes the necessary roles with associated claims, and assign these roles to users accordingly. This approach allows you to customize the claims included in the user's access token when they authenticate with Microsoft Identity.

AppRoles is the way to go. https://learn.microsoft.com/en-us/entra/identity-platform/howto-add-app-roles-in-apps#app-roles-vs-groups