title: azure ad difference between group based and role based authorization
body: <p>Hi recently I started working on azure ad. I have started working on authorization for my .net core apis. I have an below understanding on azure ad roles and groups.</p>
  
  <p><strong>Azure AD groups</strong>.
  Groups nothing but grouping of users belongs to same business. 
  One user can belongs to many groups.
  Whenever new user is added, we can associate user to different groups. </p>
  
  <p><strong>Azure AD groups based authorization for .net core</strong>
  we will have apis on our .net core application. so bringing together above azure ad groups and my .net core application, we can have plociy based authorization. For example, few apis can be accessed by certain groups.
  For example,</p>
  
  <pre><code>services.AddAuthorization(options =&gt;
              {   
                  options.AddPolicy("GroupsCheck", policy =&gt;
                  {
                      policy.AuthenticationSchemes.Add(JwtBearerDefaults.AuthenticationScheme);
                      policy.RequireAuthenticatedUser();
                      policy.Requirements.Add(new GroupsCheckRequirement("group id"));
                  });
              });
  </code></pre>
  
  <p>So whenever I have [Authorize(Policy = "GroupsCheck")] on top of controller, only if user belongs to correspond group id then he will have access to those apis.</p>
  
  <p><strong>Azure AD roles</strong>
  Azure ad roles can be assigned to above said groups. Thee roles are used to give access to Azure ad services. For example one role can have access to virtual machines and other roles can have access to networking things. So whenever we apply role to groups corresponding users in that groups will get said permissions. </p>
  
  <p>this is my understanding. Please correct me If I have wrong understanding. </p>
  
  <p>Now my confusion starts here. </p>
  
  <p>Groups does two things main. First one is we can do authorization in our .net app and next is we can groups together users using groups and we can assign roles. But something confusing me is role based authorization in .net core app. RBAC in azure is fine grained access to different users/groups. What would be the relation between RBAC in my .net core app and azure. </p>
  
  <p><strong>Admin consent</strong> </p>
  
  <p>The other thing is for example I have azure ad user role and I have created .net core app and registered in azure ad. Now my app needs to access microsoft graph. So to give microsoft graph access to my app tenant admin has to give consent. For example to read all the groups in tenants app should call microsoft graph. This is my understanding on admin consent.</p>
  
  <p>Can someone help me to understand these things correctly? Any help would be appreciated. Thanks </p>