# Azure AD Groups \> Vault Roles

**URL:** <https://discuss.hashicorp.com/t/azure-ad-groups-vault-roles/7864>\
**Category:** Vault\
**Created:** [April 20, 2020, 3:08pm UTC](https://discuss.hashicorp.com/t/azure-ad-groups-vault-roles/7864 "2020-04-20T15:08:53Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![lwilliams10](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/lwilliams10/32/6152_2.png) [@lwilliams10](https://discuss.hashicorp.com/u/lwilliams10)\
**Post date:** [April 20, 2020, 3:08pm UTC](https://discuss.hashicorp.com/t/azure-ad-groups-vault-roles/7864/1 "2020-04-20T15:08:53Z")

</div>

Hi,

I’ve configured an OIDC auth method to vault using Azure AD, I can successfully authenticate as users granted access to the app registration. I now need to assign users Vault roles based on if they are a member of an Azure AD group.

I was wondering if anybody was able to expand upon this statement in the docs:

Finally Azure AD group can be referenced by using the groups `objectId` as the [group alias name](https://www.vaultproject.io/api/secret/identity/group-alias) for the external group.

(source: [https://www.vaultproject.io/docs/auth/jwt\_oidc\_providers.html#azure-active-directory-aad-](https://www.vaultproject.io/docs/auth/jwt_oidc_providers.html#azure-active-directory-aad-))

My role configuration to allow access to a “green” kv engine looks like this:

> vault write auth/oidc/role/green   
> bound\_audiences=“Azure AD Client ID”   
> allowed\_redirect\_uris=“[https://mydomain:8200/ui/vault/auth/oidc/oidc/callback](https://mydomain:8200/ui/vault/auth/oidc/oidc/callback)”   
> allowed\_redirect\_uris=“[http://localhost:8250/oidc/callback](http://localhost:8250/oidc/callback)”   
> oidc\_scopes=“[https://graph.microsoft.com/.default](https://graph.microsoft.com/.default)”   
> user\_claim=“email”   
> groups\_claim=“groups”  
> policies=“green”

I need to create a “green” azure AD group and reference that somehow, but I’m not sure how from the available documentation.