Microsoft Learning: Work with users, groups, and roles in custom apps and APIs

Role-based access control (RBAC) is a popular mechanism to enforce authorization in applications. The administrator assigns roles to different users and groups to control who can access to what content and functionality. Using RBAC with Application Roles and Role Claims, developers can securely enforce authorization in their apps with little effort on their part. Another approach is to use Microsoft Entra ID Groups and Group Claims.