title: How to use Azure AD to generate tokens with role definition
body: <p>I have this scenario: I have an App Service, I set its authorization as Allow Anonymous Request and the Authentication Provider as Active Directory setting an Azure AD App.</p>
  
  <p>In this AD App I put in its manifest some roles like this one:</p>
  
  <pre><code>"appRoles": [
      {
        "allowedMemberTypes": [
          "User"
        ],
        "displayName": "Approver",
        "id": "8f29f99b-5c77-4fba-a310-4a5c0574e8ff",
        "isEnabled": true,
        "description": "Approvers can mark documents as approved",
        "value": "approver"
      },
  </code></pre>
  
  <p>Posting to the URL <a href="https://login.windows.net/" rel="nofollow noreferrer">https://login.windows.net/</a>/oauth2/token with my AD App ID I receive a token and what I expected to was to find the role in this token. It doesn't work like this and I couldn't find out the reason. </p>
  
  <p>What I want is to generate the token using Azure and in my API, to set an [Authorize(Role="approver")] to filter controllers accessed by different clients using the same tenant.</p>