I have configured Azure AD as an enterprise connection, and use the rule as shown here (Azure AD : can't get groups for guest azure ad users - #4 by francois.beauchemin) to include the groups a user is member of to the app_metadata field of the user profile.
However, I would like to map those groups to the groups as defined in the Authorization extension or - at least - have them listed in the id_token.
The idea is to go from AD user group to permissions (using roles).
Any suggestion?