title: Dotnet Core 2.2 - Azure AD Auth Work but Roles Base Returns Access Denied
body: <p>I'm trying to get roles working in .Net Core 2.2 and none of the other solutions have worked.</p>
  
  <p>In the <code>Startup.cs</code>, Microsoft generates this code in a new .Net 2.2 which doesn't work for some reason but getting this block to work isn't the topic though it would be nice to know why it doesn't. Says "No authenticationScheme was specified, and there was no DefaultChallengeScheme found." But it is what Microsoft generated.</p>
  
  <pre><code>services.AddAuthentication(AzureADDefaults.AuthenticationScheme)
                  .AddAzureAd(options =&gt; Configuration.Bind("AzureAd", options));
  </code></pre>
  
  <p>In my real <code>Startup.cs</code> I've had to use what's below</p>
  
  <pre><code>services.AddAuthentication(sharedOptions =&gt;
              {
                  sharedOptions.DefaultScheme = CookieAuthenticationDefaults.AuthenticationScheme;
                  sharedOptions.DefaultChallengeScheme = OpenIdConnectDefaults.AuthenticationScheme;
              })
              .AddAzureAd(options =&gt; Configuration.Bind("AzureAd", options))
              .AddCookie();
  </code></pre>
  
  <p>So the above is the only way I've gotten Azure AD to work with the <code>[Authorize]</code> attribute. The issue is that when I try to authorize with roles. I've tried many of the suggestions but haven't had any success. Anytime I have an <code>[Authorize(Roles="")]</code> I get redirected to the <code>AccessDenied()</code> method in the <code>AccountController</code> that Microsoft generated for Azure AD, basically Access Denied. I'm using roles that I've made in AD, also made a group in Azure AD, also using a role called "Domain Users" which is basically given to every employee in the company and is the most basic authorization that every employee has. If "Domain Users" gets "access denied" then I have no idea what I'm not understanding here.</p>
  
  <p>I've followed Microsoft docs for roles but there's nothing there that says I need to add more to the <code>services.AddAuthentication()</code> options.</p>