Explanation
To configure Manifest to include Group Claims in Auth Token
* Go to Azure Active Directory to configure the Manifest. Click on Azure Active Directory, and go to App registrations to find your application:
* Click on your application (or search for it if you have a lot of apps) and edit the Manifest by clicking on it.
* Locate the "groupMembershipClaims" setting. Set its value to either "SecurityGroup" or "All". To help you decide which:
* "SecurityGroup" - groups claim will contain the identifiers of all security groups of which the user is a member.
* "All" - groups claim will contain the identifiers of all security groups and all distribution lists of which the user is a member Now your application will include group claims in your manifest and you can use this fact in your code.
Reference:
https://blogs.msdn.microsoft.com/waws/2017/03/13/azure-app-service-authentication-aad-groups/