You are building a multi-tenant Web API secured by Azure AD. The API must authorize users based on roles (for user-delegated access) and also allow background services to call it with app-only permissions using roles. Tokens should carry role claims that your API can evaluate. What should you implement?

The correct options describe how to use Azure AD app roles for both user-delegated and app-only authorization. For user-delegated access, defining app roles with allowedMemberTypes set to "User" allows assigning users or groups to these roles, and the API can then validate the roles claim in the user's access token. For background services (daemon apps) requiring app-only permissions, defining app roles with allowedMemberTypes set to "Application" enables assigning these roles directly to the calling service principal, and the API validates the roles claim in the app-only token. This approach provides a clear and secure way to manage permissions. Representing roles as delegated permissions (scopes) is incorrect because scopes define what an application can do on behalf of a user, not the user's role within the application itself, and app-only tokens do not typically carry scp claims for application roles. While Azure AD groups can be used for authorization, directly using app roles is the recommended and more explicit way to define application-specific permissions, especially when differentiating between user and application roles. The "emit groups as roles" setting is a legacy option and not the primary method for defining application roles.