Grafana azure sso login is always giving Viewer role even though user is assigned to Admin and Editor role groups?

### Discussed in https://github.com/grafana/grafana/discussions/70520 <div type='discussions-op-text'> ^{Originally posted by **SudeshnaBora** June 22, 2023} I have a grafana application registered in azure AD. The appRole mentioned in the manifest is assigned to azure groups I have created. To run the grafana application locally, I have the following config and docker file. The grafana configuration is as follows : ``` [auth.azuread] name = Azure AD enabled = true allow_sign_up = true auto_login = true client_id = <client_id> client_secret = <client_secret> scopes = openid email profile auth_url = https://login.microsoftonline.com/<tenant_id>/oauth2/v2.0/authorize token_url = https://login.microsoftonline.com/<tenant_id>/oauth2/v2.0/token allowed_domains = allowed_groups = <group_id1> <group_id2> role_attribute_strict = false allow_assign_grafana_admin = true skip_org_role_sync = true force_use_graph_api = true [log] level = "debug" ``` The docker compose is as follows : ``` version: '3.9' services: grafana: image: grafana/grafana:9.4.7-ubuntu ports: - 3000:3000 restart: unless-stopped volumes: - ./grafana_config.ini:/etc/grafana/grafana.ini - grafana-data:/var/lib/grafana volumes: grafana-data: ``` While trying to log in , I am always logged into as Viewer role even though I am Editor. Onwards to debugging, I first tried to check if the correct roles and groups are returned by the access token. While trying to get the access token , I realised that `azure access_token` do not give roles and groups. Only id_token gives us the roles and groups. This I verified as follows : After getting the authorization code following this tutorial https://learn.microsoft.com/en-us/azure/databricks/dev-tools/app-aad-token#interactive . i used the following curl command ``` curl -X POST -H 'Content-Type: application/x-www-form-urlencoded' \ https://login.microsoftonline.com/<tenant_id>/oauth2/v2.0/token \ -d 'client_id=<client_id>' \ -d …