Defining Required Role Authorization

In Save Options, enter the roles that the JWT must contain in Required Role. Enter one role or multiple comma-separated values. Required Role is an application-specific policy; different Application Tokens can require different role sets even when they use the same Entra integration.

Figure – Required roles for JWT authorization

The matching behavior is subset / AND. Every role configured in Required Role must be present in the JWT roles claim. For example, a token with Role1, Role2, and Role3 is authorized for an Application Token requiring Role1 and Role2. It is rejected when the Application Token requires Role1 and Role4.

Leaving Required Role empty disables role authorization for that Application Token. Token-format, signature, issuer, audience, tenant, caller, lifetime, source-address, and Vault-access checks still apply.