I have setup a Entra External ID Tenant and registered two applications “frontend” and “backend”. The frontend is a Angular application and the backend is a asp.net core application.

So far I can authenticate the client and read the user’s roles from the claims in my web api controller like this:

var user = (HttpContext.User.Identity as ClaimsIdentity);
if(user == null){
    return Array.Empty<RolesEnum>();
}
var roles = user.Claims.Where(claim => claim.Type == ClaimTypes.Role)

I have created a custom attribute for my user and did set it via Microsoft.Graph. When I include the custom attribute in the ID Token of the frontend, the Angular application will find the ID token in the the user object returned from the MSAL Library.

I need this value on the server side but the Bearer Token does not include this value, even if I configure the custom attribute for the Token type “Access”.

Do I understand correctly, that Token configuration for my backend app is actually for the comunication between backend and other services?

Why is this custom attribute not in the Access Token (is that the bearer Token?) even if I configure it like that?