title: Azure AD B2C - Role management
body: <p>I have an Asp.NET MVC Application connected with Azure AD B2C.</p>
  
  <p>In the Administrator settings I've created an Administrators Group:</p>
  
  <p><a href="https://i.stack.imgur.com/7xTKl.jpg" rel="noreferrer"><img src="https://i.stack.imgur.com/7xTKl.jpg" alt="enter image description here"></a></p>
  
  <p>In my code I would like to use <code>[Authorize(Roles = "Administrator")]</code></p>
  
  <p>With regular Azure Active Directory it was easy to add (just 3 lines of code). But for the Azure AD B2C I cannot find any tutorial or example in the web which is working. Maybe you can tell me what i need to modify.</p>
  
  <p>Here is the ConfigureAuth method of my  Startup.Auth.cs</p>
  
  <pre class="lang-cs prettyprint-override"><code>public void ConfigureAuth(IAppBuilder app)
  {
      app.SetDefaultSignInAsAuthenticationType(CookieAuthenticationDefaults.AuthenticationType);
  
      app.UseCookieAuthentication(new CookieAuthenticationOptions());
  
      app.UseOpenIdConnectAuthentication(
          new OpenIdConnectAuthenticationOptions
          {
              // Generate the metadata address using the tenant and policy information
              MetadataAddress = String.Format(AadInstance, Tenant, DefaultPolicy),
  
              // These are standard OpenID Connect parameters, with values pulled from web.config
              ClientId = ClientId,
              RedirectUri = RedirectUri,
              PostLogoutRedirectUri = RedirectUri,
  
              // Specify the callbacks for each type of notifications
              Notifications = new OpenIdConnectAuthenticationNotifications
              {
                  RedirectToIdentityProvider = OnRedirectToIdentityProvider,
                  AuthorizationCodeReceived = OnAuthorizationCodeReceived,
                  AuthenticationFailed = OnAuthenticationFailed,
              },
  
              // Specify the claims to validate
              TokenValidationParameters = new TokenValidationParameters
              {
                  NameClaimType = "name"
              },
  
              // Specify the scope by appending all of the scopes requested into one string (separated by a blank space)
              Scope = $"openid profile offline_access {ReadTasksScope} {WriteTasksScope}"
          }
      );
  }
  </code></pre>