IMHO, Azure AD has problems with AuthZ: It's too easy to accidentally only do AuthN*, it's too underdocumented, customization is non-trivial... In general, you'

IMHO, Azure AD has problems with AuthZ: It's too easy to accidentally only do AuthN*, it's too underdocumented, customization is non-trivial... In general, you're much better off only taking the AuthN part, and implementing AuthZ yourself. It's not as if the lower tier Azure AD allows you to look at useful logs anyway. * The bug here being too wide a scope, or more likely, the scope not being checked at all. Not the first time this class of bug has happened with a Microsoft product on Azure: https://news.ycombinator.com/item?id=35364383 https://news.ycombinator.com/item?id=35364383