Microsoft Entra ID sends groups as a claim in the token, not as a scope.
- In the application's menu, select Token configuration, then Add groups claim.
- Tick only Groups assigned to the application.
- Under ID, keep Group ID.
- Select Add.
Groups assigned to the application requires Microsoft Entra ID P1 or higher. Without P1, tick Security groups instead. A user who belongs to more than 200 groups is then sent without any groups.