title: Retrieving Azure AD Group information with JWT
body: <p>I have APIs that require Azure AD bearer authentication.</p>
  
  <pre><code>public void ConfigureAuth(IAppBuilder app)
  {
     app.UseWindowsAzureActiveDirectoryBearerAuthentication(
        new WindowsAzureActiveDirectoryBearerAuthenticationOptions
        {
           // ...
        });
  }
  </code></pre>
  
  <p>Is it then possible to query Azure AD - perhaps using the Graph API - to determine the group information of the calling user? The end goal here is to apply role-based security to the API methods/controllers, as below (or similar).</p>
  
  <pre><code>[PrincipalPermission(SecurityAction.Demand, Role = "Admin")]
  </code></pre>
  
  <p>Additionally, how and where is the identity information applied to the executing thread?</p>