Scope/Role/Group Based Access Control

Question

I am using Azure Active Directory and am trying to understand the three types of access control described here. What are the advantages and disadvantages of each approach and when would you use them:

• Scope based access control using oauth2Permissions section of my manifest where I can add read and write permissions like so:

  {
    "adminConsentDescription": "Allow the application read access to MyApi on behalf of the signed-in user.",
    "adminConsentDisplayName": "Read access to MyApi",
    "id": "56d944c0-f3aa-4f80-9472-9c1414383abf",
    "isEnabled": true,
    "type": "User",
    "userConsentDescription": "Allow the application read access to MyApi on your behalf.",
    "userConsentDisplayName": "Read access to MyApi",
    "value": "read_my_api"
  },
  {
    "adminConsentDescription": "Allow the application write access to MyApi on behalf of the signed-in user.",
    "adminConsentDisplayName": "Write access to MyApi",
    "id": "6d66a2bd-c8c7-4ee0-aef4-9424b51b4967",
    "isEnabled": true,
    "type": "User",
    "userConsentDescription": "Allow the application write access to MyApi on your behalf.",
    "userConsentDisplayName": "Write access to MyApi",
    "value": "write_my_api"
  }
  

• Role Based Access Control (RBAC) - Using appRoles section of my manifest.

• Group based access control using the groupMembershipClaims section of my manifest.

Answer 1

I think the most significant difference between scopes and roles/groups is who determines what the client is allowed to do.

• Resource scopes are granted by the resource owner (the user) to an application through the consent screen. For example, the client application can post to my timeline or see my friends list.
• User roles and groups are assigned by an administrator of the Azure AD directory. For example, the user can submit expense reports or the user can approve expense reports.

Scopes are typically used when an external application wants to gain access to the user's data via an exposed API. They determine what the client application can do.

Role- or group based access is typically used within an application to determine what a user can do.