title: Azure AD v2 roles not included in Access Token
body: <p>I'm using <a href="https://login.microsoftonline.com/.../oauth2/v2.0/token" rel="noreferrer">https://login.microsoftonline.com/.../oauth2/v2.0/token</a> to authenticate (authorization_code grant) to azure Ad using the scopes: offline_access, openid, profile, User.Read</p>
  <p>According to the documentation the Access Token I receive should contain the roles of the user:
  <a href="https://docs.microsoft.com/en-us/azure/active-directory/develop/access-tokens" rel="noreferrer">https://docs.microsoft.com/en-us/azure/active-directory/develop/access-tokens</a></p>
  <p>However only the identity token returns the roles:</p>
  <pre><code>--Access Token
  {
    &quot;typ&quot;: &quot;JWT&quot;,
    &quot;nonce&quot;: &quot;IWTwK2P0vzHoNnv1vvvSsjZSbAYPpSIk8MozY0A4WR0&quot;,
    &quot;alg&quot;: &quot;RS256&quot;,
    &quot;x5t&quot;: &quot;nOo3ZDrODXEK1jKWhXslHR_KXEg&quot;,
    &quot;kid&quot;: &quot;nOo3ZDrODXEK1jKWhXslHR_KXEg&quot;
  }.{
  ...
    &quot;rh&quot;: &quot;0.ASgASPp-HouAsUyXCdG05vvfeHAoPPG46TFOoWYsil-LDcsoADw.&quot;,
    &quot;scp&quot;: &quot;User.Read profile openid email&quot;,
  ...
  }.[Signature]
  </code></pre>
  <hr />
  <pre><code>--Identity Token
  {
    &quot;typ&quot;: &quot;JWT&quot;,
    &quot;alg&quot;: &quot;RS256&quot;,
    &quot;kid&quot;: &quot;nOo3ZDrODXEK1jKWhXslHR_KXEg&quot;
  }.{
  ...
    &quot;rh&quot;: &quot;0.ASgASPp-HouAsUyXCdG05vvfeHAoPPG46TFOoWYsil-LDcsoADw.&quot;,
    &quot;roles&quot;: [
      &quot;MyApp.Read&quot;,
      &quot;MyApp.Admin&quot;,
      &quot;MyApp.Write&quot;,
    ],
  ...
  }.[Signature]
  </code></pre>
  <p>Is there a way to make the access token also include the roles?</p>