There is already a lot of questions like this but I did not really find an answer.

Context:
I have 2 app in app registrations : app1 and app2.
App1 needs to access resources from app2 and it would be really convenient to have those values in the access token. The lifetime of the token is not an issue, a change does not need to be effective instantly.

We set up some roles in app2 but we need more granularity and roles does not fit what we want.

What I try/research:
Optional claims in app registration: Only allow to expose pre-existing claims (and does not work with client credential flow)
Custom claims in enterprise application (with custom authentication extension): would perfectly fit my needs but does not work with client credentials flow.
Claims mapping policy: Seems to also only work with pre-existing values.

I do not have the feeling what we’re trying to do is rocket science but it seems each time I find something interesting it’s just not usable.