I am using role assignments on applications extensively. When I generate a token for my API as a user, I get the roles that I have been assigned.

For instance, here I am in a group and that group has been assigned the role Developer:

When I generate a token for the API that this principal protects, I get the following in the resulting JWT:

"roles": [
  "Developer"
]

The token is generated using OAuth 2.0, where a SPA is the client that is in the azp claim of the resulting token.

Now I want to do the same thing, but from APIM and for a principal. APIM has a user-assigned managed identity that I have assigned an Application-only role over the same principal as in the first image. The assignment is in place on the principal backing the managed identity:

To verify, I’ve added an operation to APIM with the following policy:

<inbound>
    <authentication-managed-identity resource="api://{{the-api-I-want-toca--}}" client-id="{{apim-clientId}}" output-token-variable-name="access-token" ignore-error="false" />
    <return-response>
        <set-status code="200" reason="OK" />
        <set-body>@("Bearer " + (string)context.Variables["access-token"])</set-body>
    </return-response>
</inbound>

I can call this operation and I get a token back, but there is no role claim or any other metadata on the token at all.

What I want to achieve is the ability to determine what kind of permissions a principal has based on the role claim, the same way I can do with user accounts.

Am I misinterpreting something here? How come it doesn’t behave the same way for principals as it does for users? How can I achieve the same behaviour in my new use case with principals?