OIDC Authentication - Roles Not Included in UserInfo Response

Question

Hello Azure Community,

We are currently facing an issue with our OIDC authentication setup in Azure AD, where user roles are not being returned in the UserInfo response.

What We Have Done So Far:

• Configured App Roles under our Azure AD application and assigned them to users/groups.
• Granted the following Microsoft Graph API permissions (Delegated):
  • Group.Read.All (Admin consent granted)
  • email
  • openid
  • User.Read
  • Verified that admin consent has been properly granted for all required permissions.
  • Tested the authentication flow, but roles do not appear in the UserInfo endpoint response.

Issue:

Even though roles are properly assigned in App Roles, they are not being returned when fetching user information via the /userinfo endpoint in the OIDC authentication flow.

Question:

• How can we ensure that the roles assigned via App Roles are included in the OIDC UserInfo response?
• Are there additional configurations needed to retrieve roles in the authentication token?
• Has anyone successfully retrieved app roles in the OIDC UserInfo endpoint response, and if so, what was your approach?

I have attached screenshots of our App Roles and API permissions setup for reference.

Any guidance or insights from the community would be greatly appreciated!

Thanks in advance