title: Role Claims when Federating Azure AD
body: <p>We want to create a MVC web application using claims-based authentication, expecting roles as one of the claims.  We want to Federate authentication providers using the Azure Access Control Service to manage this federation.  One of the authentication providers is our Azure AD. </p>
  
  <p>The problem is that Azure AD doesn't seem to be able to generate role (or even group) claims.  What is the appropriate method to manage group or role access in Azure AD and have role claims served by Azure Access Control Service. </p>
  
  <p>Thanks.</p>
  
  <p><strong>Edit:</strong> </p>
  
  <p>A previous comment asked for details:  We want to provide access to our cloud application to 3rd parties using their active directory (to simplify user management for them).  Our application has a few levels of access to information that the 3rd parties can configure.  We were hoping they could do this in their AD (based on our instructions).  Groups seemed like the obvious choice, but if there is another way that works, as long as we can provide instructions, it'll work.</p>
  
  <p>We want our application to get claims for a user's level of access.  If we had only one partner that was using Azure AD, we could use the graph API against that endpoint, but with multiple partners changing over time, we wanted to federate them so our application only needs to trust the federation server.  We were assuming that we needed Azure ACS to manage the federation.</p>