---
title: Defining Required Role Authorization
slug: kronpam-reference-guide-3-9-0/defining-required-role-authorization
docTags: 
createdAt: 2026-10-10T13:35:01.483Z
---

In Save Options, enter the roles that the JWT must contain in Required Role. Enter one role or multiple comma-separated values. Required Role is an application-specific policy; different Application Tokens can require different role sets even when they use the same Entra integration.

![](https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/8VuGSbOvJT2Soix9JUMST_image.png "Figure – Required roles for JWT authorization")

The matching behavior is subset / AND. Every role configured in Required Role must be present in the JWT roles claim. For example, a token with Role1, Role2, and Role3 is authorized for an Application Token requiring Role1 and Role2. It is rejected when the Application Token requires Role1 and Role4.

:::hint{type="info"}
Leaving Required Role empty disables role authorization for that Application Token. Token-format, signature, issuer, audience, tenant, caller, lifetime, source-address, and Vault-access checks still apply.
:::