title: Asp.net Core 2.0 Authentication using Azure AD - restrict authentication to only certain azure AD Groups
body: <p>I have ASP.NET Core 2.0 Web API protected using 4 Azure AD groups. I am using JWT beaer tokens. All users have to be in one of these 4
  azure ad groups to be able to access the application.</p>
  <p>Now, I have other users existing in the Azure ad domain, who can also login and access the application. How can we restrict this?  I want only users in those 4 Azure groups to be able to access my application. Those users can be allowed to login, but after login it should say you are not allowed to access the application. This should happen before any authorization logic starts inside the application (Start.cs)</p>
  <p>I see,
  AuthenticationFailed, Challenge, TokenValidated methods in ASP.NET Core 2.0</p>
  <p>How do I handle this?</p>