Azure ad group membership claims

azure, azure-active-directory

Solution

Sorry for wasting people's time here. I was asking this question for a friend, and turns out they were looking at the access token, not the id token.

So as future reference, make sure you are requesting an id token from AAD, and use that to figure out things like group memberships.

Problem

I've set the groupMembershipClaims property in an app's manifest in Azure AD to "All", which should result in a user's security group memberships to be returned in the id token. However, they are not being returned. Have tried to re-login multiple times. Is there something I am doing obviously wrong?

Original source