App roles, the roles claim, and 'Assignment required' on enterprise applications

Many applications need their own authorization, such as distinguishing readers from approvers in an expense app. Rather than building a separate user database, developers can define app roles in Microsoft Entra ID and let administrators assign users to them. The app then reads the user's roles from the token and makes decisions.