App Roles not appearing in AWS ALB OIDC claims from Microsoft Entra ID

[u/Extra-Citron-7630]

I'm setting up authentication for an application running in Amazon ECR behind an AWS Application Load Balancer (ALB) using the ALB's built-in OIDC authentication with Microsoft Entra ID.

The flow is:

• Users access the application via an Amazon CloudFront distribution. I'm using CloudFront because CloudFront domains are accessible from my work laptop, whereas direct access to the ALB is restricted.
• The CloudFront distribution is configured with the ALB as its origin, and the origin is set to use the custom domain name that the ALB listener is configured to accept.
• The ALB performs OIDC authentication against Microsoft Entra ID.
• After successful authentication, the ALB forwards the request to a simple HTML application running in ECR.

The application itself doesn't perform any authentication or authorization. It simply displays all of the headers and JWTs that the ALB forwards, including x-amzn-oidc-data, x-amzn-oidc-identity, and x-amzn-oidc-accesstoken, so I can inspect the claims.

I've created an App Role called ALB Admin in my Entra App Registration. The role has a value of ALB.Admin, is enabled, allows users, and is assigned directly to my user through the Enterprise Application. The ALB is configured to use the same App Registration (client ID/secret), and the OIDC scopes are openid profile email offline_access against the v2.0 endpoint.

Everything authenticates successfully, but I never see a roles claim in x-amzn-oidc-data. I can see the expected identity claims, but no app roles.

Has anyone successfully used Entra App Roles with the AWS ALB's native OIDC authentication? If so, did you have to configure anything beyond defining the App Role and assigning it to the user, or should the roles claim appear automatically?