I'm trying to understand the practical difference between API permissions and app roles in Microsoft Entra ID. My understanding is that API permissions are configured on an app registration and determine what the application can access in services such as Microsoft Graph or Exchange Online. App roles seem to be permissions that an application exposes to its users or client applications, but I'm unclear about when they are needed and where they should be configured. I've created several app registrations for development teams to connect to Azure resources without defining any app roles, so I'd also like to understand whether that is expected. For example, if a web application has Guest, User, and Admin roles, how do I assign those roles to specific users or groups?
2 Answers
App roles are included in the token issued for the application. Your code reads the roles claim and decides what the signed-in user can do; defining an app role does not automatically grant permissions in Azure or change the app registration’s own access. To assign them, first define the roles under the app registration’s App roles section. Then open the corresponding enterprise application, go to Users and groups, add a user or group, and select the appropriate role—such as Guest, User, or Admin. Users assigned through that enterprise application will receive the assigned role in their token, assuming the application requests the appropriate sign-in token.
The easiest distinction is: API permissions describe what your application is allowed to access in another service, such as Microsoft Graph, Exchange Online, or a custom API. App roles describe what users, groups, or client applications are allowed to do within the application that defines those roles. If an app only needs to call Azure or Microsoft APIs, it may not need any app roles. Azure RBAC and IAM permissions are separate from both of these.
So if I define Guest, User, and Admin roles for a web application, how do I assign each role to specific users or groups? I expected to see a role selector somewhere in the app registration.