An ASP.NET Core app in Azure App Service requires custom claims from Microsoft Entra ID in the user access token. The claims should be removed automatically if the app registration is deleted. How should you include the custom claims in the access token?

Adding roles to the appRoles attribute in the app registration manifest is the correct way to include custom claims that are automatically removed if the app registration is deleted. This method allows you to define custom roles within your application, which Microsoft Entra ID then includes as claims in the user's access token. If the app registration is deleted, these roles and their associated claims cease to exist. Requesting the https://graph.microsoft.com/.default scope is for granting permissions to Microsoft Graph, not for adding custom claims to an access token. Configuring the OAuth 2.0 authorization code flow is a general authentication mechanism and doesn't specifically address custom claims. Custom middleware could fetch role information, but it wouldn't be automatically removed with app deletion and isn't the standard, declarative way to add claims to the token itself. Adding groups to groupMembershipClaims includes group IDs, not custom, application-specific roles.