如何通过Azure广告检查用户是否在广告组中?

• .NET 4.5.1 MVC项目
• 项目包含.aspx文件(旧版)
• Azure门户(通过应用程序注册)配置了“隐式授权ID令牌”和“仅此组织目录中的帐户”
• 本地广告组被推到Azure广告。

// COOKIES: Tells it to use cookies for authentication.
app.SetDefaultSignInAsAuthenticationType(CookieAuthenticationDefaults.AuthenticationType);
app.UseCookieAuthentication(new CookieAuthenticationOptions()
{
    CookieManager = new SystemWebCookieManager()
});

app.UseOpenIdConnectAuthentication(new OpenIdConnectAuthenticationOptions()
{
    ClientId = ClientID,
    Authority = Authority,
    PostLogoutRedirectUri = PostLogoutRedirectUri,
    Notifications = new OpenIdConnectAuthenticationNotifications()
    {
        AuthenticationFailed = PrincipalService.OnAzureAuthenticationFailure,
        AuthorizationCodeReceived = (AuthorizationCodeReceivedNotification notification) =>
        {
            var username = notification.AuthenticationTicket.Identity.Name.Split('#').LastOrDefault();
            var emailAddress = notification.AuthenticationTicket.Identity.Claims.FirstOrDefault(x => x.Type.Contains("emailaddress"))?.Value;
            Logger.Log(Level.Auth, $"Azure login success! Username: '{username}' Email: '{emailAddress}'.");
            return Task.FromResult(0);
        }
    }
});

问题

我试过的

GetAccountsAsync 返回空的等)。

"optionalClaims": {
    "idToken": [
        {
            "name": "email",
            "source": null,
            "essential": true,
            "additionalProperties": []
        },
        {
            "name": "groups",
            "source": null,
            "essential": true,
            "additionalProperties": []
        }
    ],
    "accessToken": [],
    "saml2Token": []
}

email 很好,但很明显 groups 因为那是在黑暗中拍摄的。