diff --git a/frontend/src/auth/AuthProvider.test.tsx b/frontend/src/auth/AuthProvider.test.tsx
index e96e138087..e3023b1e28 100644
--- a/frontend/src/auth/AuthProvider.test.tsx
+++ b/frontend/src/auth/AuthProvider.test.tsx
@@ -1,3 +1,4 @@
+import { StrictMode } from "react";
 import { render, screen, waitFor } from "@testing-library/react";
 
 // ---------------------------------------------------------------------------
@@ -26,11 +27,8 @@ jest.mock("./msalConfig", () => ({
 }));
 
 const mockSetMsalInstance = jest.fn();
-const mockSetClientId = jest.fn();
-
 jest.mock("../services/api", () => ({
   setMsalInstance: (...args: unknown[]) => mockSetMsalInstance(...args),
-  setClientId: (...args: unknown[]) => mockSetClientId(...args),
 }));
 
 // MSAL browser mocks — PublicClientApplication instance methods
@@ -39,7 +37,6 @@ const mockHandleRedirectPromise = jest.fn().mockResolvedValue(null);
 const mockGetActiveAccount = jest.fn().mockReturnValue(null);
 const mockGetAllAccounts = jest.fn().mockReturnValue([]);
 const mockSetActiveAccount = jest.fn();
-const mockAddEventCallback = jest.fn();
 const mockLoginRedirect = jest.fn().mockResolvedValue(undefined);
 
 jest.mock("@azure/msal-browser", () => ({
@@ -49,7 +46,6 @@ jest.mock("@azure/msal-browser", () => ({
     getActiveAccount: mockGetActiveAccount,
     getAllAccounts: mockGetAllAccounts,
     setActiveAccount: mockSetActiveAccount,
-    addEventCallback: mockAddEventCallback,
     loginRedirect: mockLoginRedirect,
   })),
   EventType: { LOGIN_SUCCESS: "msal:loginSuccess" },
@@ -78,6 +74,7 @@ jest.mock("@azure/msal-react", () => ({
 }));
 
 import { AuthProvider } from "./AuthProvider";
+import type { AuthConfig } from "./msalConfig";
 
 // ---------------------------------------------------------------------------
 // Tests
@@ -95,8 +92,11 @@ describe("AuthProvider", () => {
   });
 
   // Test 10: fetchAuthConfig never resolves → stuck in loading state
-  it("shows loading state while initializing", () => {
-    mockFetchAuthConfig.mockReturnValue(new Promise(() => {}));
+  it("shows loading state while initializing", async () => {
+    let resolveConfig: (config: AuthConfig) => void = () => {}
+    mockFetchAuthConfig.mockReturnValue(new Promise((resolve) => {
+      resolveConfig = resolve
+    }));
 
     render(
       <AuthProvider>
@@ -105,6 +105,8 @@ describe("AuthProvider", () => {
     );
 
     expect(screen.getByText("Initializing authentication...")).toBeVisible();
+    resolveConfig({ clientId: "", tenantId: "", allowedGroupIds: "" });
+    await screen.findByText("Child");
   });
 
   // Test 11: empty clientId + tenantId → auth disabled, children render directly
@@ -200,7 +202,29 @@ describe("AuthProvider", () => {
     expect(mockInitialize).toHaveBeenCalled();
     expect(mockHandleRedirectPromise).toHaveBeenCalled();
     expect(mockSetMsalInstance).toHaveBeenCalled();
-    expect(mockSetClientId).toHaveBeenCalledWith("test-client");
+  });
+
+  it("handles the redirect once when Strict Mode replays effects", async () => {
+    mockFetchAuthConfig.mockResolvedValue({
+      clientId: "test-client",
+      tenantId: "test-tenant",
+      allowedGroupIds: "g1",
+    });
+
+    render(
+      <StrictMode>
+        <AuthProvider>
+          <div>Child</div>
+        </AuthProvider>
+      </StrictMode>
+    );
+
+    await waitFor(() => {
+      expect(screen.getByTestId("msal-provider")).toBeInTheDocument();
+    });
+    expect(mockHandleRedirectPromise).toHaveBeenCalledTimes(1);
+    expect(mockHandleRedirectPromise).toHaveBeenCalledWith({ navigateToLoginRequestUrl: false });
+    expect(mockLoginRedirect).toHaveBeenCalledTimes(1);
   });
 
   // Test 16: handleRedirectPromise returns account → setActiveAccount called
diff --git a/frontend/src/auth/AuthProvider.tsx b/frontend/src/auth/AuthProvider.tsx
index d619d03a48..34577c7b9b 100644
--- a/frontend/src/auth/AuthProvider.tsx
+++ b/frontend/src/auth/AuthProvider.tsx
@@ -10,12 +10,8 @@
  * - Shows a loading state while auth initializes
  */
 
-import { useState, useEffect, type ReactNode } from 'react'
-import {
-  PublicClientApplication,
-  EventType,
-  type AuthenticationResult,
-} from '@azure/msal-browser'
+import { useState, useEffect, useRef, type ReactNode } from 'react'
+import { PublicClientApplication } from '@azure/msal-browser'
 import {
   MsalProvider,
   AuthenticatedTemplate,
@@ -23,25 +19,28 @@ import {
   useMsal,
 } from '@azure/msal-react'
 import { fetchAuthConfig, buildMsalConfig, buildLoginRequest, type AuthConfig } from './msalConfig'
-import { AuthConfigContext, useAuthConfig } from './AuthConfigContext'
-import { setMsalInstance as setApiMsalInstance, setClientId as setApiClientId } from '../services/api'
+import { AuthConfigContext } from './AuthConfigContext'
+import { setMsalInstance as setApiMsalInstance } from '../services/api'
 
 function LoginRedirect() {
   const { instance } = useMsal()
-  const config = useAuthConfig()
+  const loginStarted = useRef(false)
 
   useEffect(() => {
+    if (loginStarted.current) return
+    loginStarted.current = true
+
     // Capture the path the user originally requested so it can be restored
     // after the login round-trip (see the redirect handling in initMsal).
     instance
       .loginRedirect({
-        ...buildLoginRequest(config.clientId),
+        ...buildLoginRequest(),
         state: window.location.pathname + window.location.search,
       })
       .catch((error) => {
         console.error('Login redirect failed:', error)
       })
-  }, [instance, config])
+  }, [instance])
 
   return <div style={{ padding: '2rem', textAlign: 'center' }}>Redirecting to login...</div>
 }
@@ -67,47 +66,33 @@ export function AuthProvider({ children }: AuthProviderProps) {
   const [authDisabled, setAuthDisabled] = useState(false)
   const [error, setError] = useState<string | null>(null)
   const [authConfig, setAuthConfig] = useState<AuthConfig>({clientId: '', tenantId: '', allowedGroupIds: ''})
+  const initializationStarted = useRef(false)
 
   useEffect(() => {
-    let cancelled = false
+    if (initializationStarted.current) return
+    initializationStarted.current = true
 
     async function initMsal() {
       try {
         const config = await fetchAuthConfig()
+        setAuthConfig(config)
 
-        // If no auth config (local dev), skip MSAL entirely
         if (!config.clientId || !config.tenantId) {
-          if (!cancelled) {
-            setMsalInstance(null) // null signals "auth disabled"
-            setAuthDisabled(true)
-            setAuthConfig(config)
-          }
+          setAuthDisabled(true)
           return
         }
 
-        const msalConfig = buildMsalConfig(config)
-        const instance = new PublicClientApplication(msalConfig)
+        const instance = new PublicClientApplication(buildMsalConfig(config))
         await instance.initialize()
+        const redirectResult = await instance.handleRedirectPromise({ navigateToLoginRequestUrl: false })
 
-        // Handle redirect response (after coming back from login)
-        instance.addEventCallback((event) => {
-          if (event.eventType === EventType.LOGIN_SUCCESS && event.payload) {
-            const result = event.payload as AuthenticationResult
-            instance.setActiveAccount(result.account)
-          }
-        })
-
-        // Await the redirect promise FIRST — on the initial redirect back
-        // from Entra, this caches the token and returns the auth result.
-        // On normal page loads (no redirect hash) it resolves to null.
-        const redirectResult = await instance.handleRedirectPromise()
         if (redirectResult?.account) {
           instance.setActiveAccount(redirectResult.account)
+        } else if (!instance.getActiveAccount()) {
+          const accounts = instance.getAllAccounts()
+          if (accounts.length > 0) instance.setActiveAccount(accounts[0])
         }
 
-        // Restore the deep link the user originally requested, captured as
-        // MSAL state before the login redirect (see LoginRedirect). Only
-        // same-origin paths are honored, guarding against an open redirect.
         const requestedPath = typeof redirectResult?.state === 'string' ? redirectResult.state : null
         if (
           requestedPath &&
@@ -117,33 +102,16 @@ export function AuthProvider({ children }: AuthProviderProps) {
           window.history.replaceState(null, '', requestedPath)
         }
 
-        // Fall back to any cached account from a previous session
-        if (!instance.getActiveAccount()) {
-          const accounts = instance.getAllAccounts()
-          if (accounts.length > 0) {
-            instance.setActiveAccount(accounts[0])
-          }
-        }
-
-        if (!cancelled) {
-          // Wire MSAL into the API client BEFORE React re-render,
-          // so child components' effects already have the token available.
-          setApiMsalInstance(instance)
-          setApiClientId(config.clientId)
-          setMsalInstance(instance)
-          setAuthConfig(config)
-        }
+        // Wire MSAL into the API client BEFORE React re-render,
+        // so child components' effects already have the token available.
+        setApiMsalInstance(instance)
+        setMsalInstance(instance)
       } catch (err) {
-        if (!cancelled) {
-          setError(err instanceof Error ? err.message : 'Failed to initialize authentication')
-        }
+        setError(err instanceof Error ? err.message : 'Failed to initialize authentication')
       }
     }
 
     initMsal()
-    return () => {
-      cancelled = true
-    }
   }, [])
 
   if (error) {
diff --git a/frontend/src/auth/msalConfig.test.ts b/frontend/src/auth/msalConfig.test.ts
index 2e36a518f8..bda21bf5fa 100644
--- a/frontend/src/auth/msalConfig.test.ts
+++ b/frontend/src/auth/msalConfig.test.ts
@@ -4,31 +4,19 @@ jest.mock("@azure/msal-browser", () => ({
   LogLevel: { Warning: 3 },
 }));
 
-import { buildMsalConfig, getApiScopes, buildLoginRequest } from "./msalConfig";
+import { buildMsalConfig, getGraphScopes, buildLoginRequest } from "./msalConfig";
 
 describe("msalConfig", () => {
-  // Tests 1-2: getApiScopes — two branches on the !clientId check (line 75)
-  describe("getApiScopes", () => {
-    it("returns default scopes when clientId is empty", () => {
-      expect(getApiScopes("")).toEqual(["openid", "profile", "email"]);
-    });
-
-    it("returns client-specific scope when clientId is provided", () => {
-      expect(getApiScopes("my-client-id")).toEqual(["api://my-client-id/access"]);
+  describe("getGraphScopes", () => {
+    it("returns the delegated Graph scope", () => {
+      expect(getGraphScopes()).toEqual(["User.Read"]);
     });
   });
 
-  // Tests 3-4: buildLoginRequest — wraps getApiScopes in { scopes }
   describe("buildLoginRequest", () => {
-    it("builds request with client-specific scopes", () => {
-      expect(buildLoginRequest("my-client-id")).toEqual({
-        scopes: ["api://my-client-id/access"],
-      });
-    });
-
-    it("builds request with default scopes when clientId is empty", () => {
-      expect(buildLoginRequest("")).toEqual({
-        scopes: ["openid", "profile", "email"],
+    it("builds request with Graph scopes", () => {
+      expect(buildLoginRequest()).toEqual({
+        scopes: ["User.Read"],
       });
     });
   });
diff --git a/frontend/src/auth/msalConfig.ts b/frontend/src/auth/msalConfig.ts
index fa7d586bce..c63e3a68cf 100644
--- a/frontend/src/auth/msalConfig.ts
+++ b/frontend/src/auth/msalConfig.ts
@@ -8,12 +8,15 @@
  * endpoint (served by the backend from environment variables). This avoids
  * hardcoding tenant-specific values in the frontend bundle.
  *
- * Uses access tokens (not ID tokens) with an API-specific scope so that
- * Entra ID includes the `groups` claim for group-based authorization.
+ * Uses a delegated Microsoft Graph access token. The backend forwards this
+ * token only to trusted Graph endpoints to authenticate the user and resolve
+ * group membership.
  */
 
 import { type Configuration, LogLevel } from '@azure/msal-browser'
 
+const GRAPH_USER_READ_SCOPE = 'User.Read'
+
 export interface AuthConfig {
   clientId: string
   tenantId: string
@@ -54,23 +57,13 @@ export function buildMsalConfig(authConfig: AuthConfig): Configuration {
   }
 }
 
-/**
-  * Build the API scopes for token acquisition.
-  *
-  * Requests the app's custom `access` scope so the resulting access token has
-  * `aud` equal to the app's client ID. The explicit scope name avoids the
-  * `.default` shorthand, which resolves via `requiredResourceAccess` and
-  * triggers mandatory admin consent in the Microsoft corporate tenant.
-  *
-  * The `access` scope is defined under "Expose an API" on the app registration.
-  */
-export function getApiScopes(clientId: string): string[] {
-  if (!clientId) return ['openid', 'profile', 'email']
-  return [`api://${clientId}/access`]
+/** Build the delegated Microsoft Graph scopes used for authentication. */
+export function getGraphScopes(): string[] {
+  return [GRAPH_USER_READ_SCOPE]
 }
 
-export function buildLoginRequest(clientId: string) {
+export function buildLoginRequest(): { scopes: string[] } {
   return {
-    scopes: getApiScopes(clientId),
+    scopes: getGraphScopes(),
   }
 }
diff --git a/frontend/src/components/UserAccountButton.test.tsx b/frontend/src/components/UserAccountButton.test.tsx
index 73035e928d..f0fa8d755f 100644
--- a/frontend/src/components/UserAccountButton.test.tsx
+++ b/frontend/src/components/UserAccountButton.test.tsx
@@ -26,7 +26,7 @@ jest.mock('../auth/AuthConfigContext', () => ({
 }))
 
 jest.mock('../auth/msalConfig', () => ({
-  buildLoginRequest: (clientId: string) => ({ scopes: [`${clientId}/.default`] }),
+  buildLoginRequest: () => ({ scopes: ['User.Read'] }),
 }))
 
 const TestWrapper: React.FC<{ children: React.ReactNode }> = ({ children }) => (
@@ -78,7 +78,7 @@ describe('UserAccountButton', () => {
 
     await user.click(screen.getByRole('button', { name: /log in/i }))
 
-    expect(mockLoginRedirect).toHaveBeenCalledWith({ scopes: ['test-client-id/.default'] })
+    expect(mockLoginRedirect).toHaveBeenCalledWith({ scopes: ['User.Read'] })
   })
 
   it('renders user display name and Sign Out when account exists', () => {
diff --git a/frontend/src/components/UserAccountButton.tsx b/frontend/src/components/UserAccountButton.tsx
index 9d258e6239..4bdc59bdd9 100644
--- a/frontend/src/components/UserAccountButton.tsx
+++ b/frontend/src/components/UserAccountButton.tsx
@@ -19,7 +19,6 @@ import { useUserAccountButtonStyles } from './UserAccountButton.styles'
 function MsalAccountButton() {
   const styles = useUserAccountButtonStyles()
   const { instance, accounts } = useMsal()
-  const config = useAuthConfig()
   const account = instance.getActiveAccount() ?? accounts[0]
 
   if (!account) {
@@ -28,7 +27,7 @@ function MsalAccountButton() {
         <Button
           appearance="subtle"
           icon={<PersonRegular />}
-          onClick={() => instance.loginRedirect(buildLoginRequest(config.clientId)).catch((error) => {
+          onClick={() => instance.loginRedirect(buildLoginRequest()).catch((error) => {
             console.error('Login redirect failed:', error)
           })}
         >
diff --git a/frontend/src/services/api.ts b/frontend/src/services/api.ts
index 5dfb44d8f0..467a7cb158 100644
--- a/frontend/src/services/api.ts
+++ b/frontend/src/services/api.ts
@@ -1,7 +1,7 @@
 import axios from 'axios'
 import { InteractionRequiredAuthError, type PublicClientApplication } from '@azure/msal-browser'
 import { toApiError } from './errors'
-import { getApiScopes } from '../auth/msalConfig'
+import { getGraphScopes } from '../auth/msalConfig'
 import type {
   TargetInstance,
   TargetListResponse,
@@ -55,16 +55,11 @@ function generateRequestId(): string {
 // ---------------------------------------------------------------------------
 
 let _msalInstance: PublicClientApplication | null = null
-let _clientId: string = ''
 
 export function setMsalInstance(instance: PublicClientApplication): void {
   _msalInstance = instance
 }
 
-export function setClientId(clientId: string): void {
-  _clientId = clientId
-}
-
 async function getAccessToken(forceRefresh = false): Promise<string | null> {
   if (!_msalInstance) return null
 
@@ -73,7 +68,7 @@ async function getAccessToken(forceRefresh = false): Promise<string | null> {
 
   try {
     const response = await _msalInstance.acquireTokenSilent({
-      scopes: getApiScopes(_clientId),
+      scopes: getGraphScopes(),
       account,
       forceRefresh,
     })
@@ -81,7 +76,7 @@ async function getAccessToken(forceRefresh = false): Promise<string | null> {
   } catch (error) {
     if (error instanceof InteractionRequiredAuthError) {
       await _msalInstance.acquireTokenRedirect({
-        scopes: getApiScopes(_clientId),
+        scopes: getGraphScopes(),
       })
     }
     return null
diff --git a/infra/DEPLOY_NEW_INSTANCE.md b/infra/DEPLOY_NEW_INSTANCE.md
index b810a928fd..489f557368 100644
--- a/infra/DEPLOY_NEW_INSTANCE.md
+++ b/infra/DEPLOY_NEW_INSTANCE.md
@@ -51,6 +51,10 @@ within an instance. The trust boundary is Entra group membership.
 > (script runtime + manual SQL user creation). Plan for this cadence if deploying
 > new instances monthly.
 
+The script configures delegated Microsoft Graph `User.Read`; the backend uses the
+token with `/me` and `/me/checkMemberGroups` and requires at least one allowed group.
+See [README.md](README.md#security) for the full authentication model.
+
 ## Quick Deploy
 
 ### 1. Prepare the .env file
diff --git a/infra/README.md b/infra/README.md
index 3c7caca363..f4af84d426 100644
--- a/infra/README.md
+++ b/infra/README.md
@@ -9,9 +9,9 @@ managed identity, security response headers, and no embedded secrets.
 ```
 Users ──→ MSAL PKCE auth ──→ Container App
                                                        ↓
-                                                 MSAL PKCE auth
+                                          Graph-backed authentication
                                                        ↓
-                                              FastAPI JWT middleware
+                                       Microsoft Graph /me + memberships
                                                        ↓
                                               User-Assigned MI
                                         ↙     ↙     ↓      ↘      ↘
@@ -58,12 +58,16 @@ Production is opt-in via `deployToProd: true`.
 
 - **Authentication**: [MSAL](https://learn.microsoft.com/en-us/entra/msal/)
   [PKCE](https://oauth.net/2/pkce/) on the frontend (`@azure/msal-browser`) +
-  FastAPI JWT middleware on the backend. Validates Bearer tokens against Entra ID
-  JWKS. PKCE (public client) — no client secrets or certificates needed.
+  Microsoft Graph-backed middleware on the backend. The frontend sends a delegated
+  Graph token, and the backend authenticates it through Graph `/me`. PKCE (public
+  client) requires no client secrets or certificates.
 - **Authorization**: Entra group check via `allowedGroupObjectIds` param. Requires
-  `groupMembershipClaims: "ApplicationGroup"` + optional claims + each security group
-  assigned to the enterprise app (see Prerequisites §3). If no group restriction is
-  set, all authenticated users pass.
+  delegated Graph `User.Read`; the backend calls `/me/checkMemberGroups` and compares
+  the returned transitive memberships with the configured group IDs. Each security
+  group must also be assigned to the enterprise app (see Prerequisites §3). Authenticated
+  deployments require at least one allowed group and fail to start without one.
+  Successful identity and membership results are cached in-process for 60 seconds by
+  token digest to reduce Graph latency and throttling; bearer tokens are never cached.
 - **Identity**: User-assigned managed identity (UAMI) — created before the container
   app so [RBAC](https://learn.microsoft.com/en-us/azure/role-based-access-control/)
   roles are active before the first revision starts. `AZURE_CLIENT_ID` is set to the
@@ -161,42 +165,30 @@ az account show --query tenantId -o tsv
 >   --spa-redirect-uris "https://$FQDN"
 > ```
 
-**Expose an API scope** (required — the frontend requests `api://{clientId}/access` tokens):
+**Configure delegated Microsoft Graph access** (required):
 
-1. In Azure Portal → App registrations → your app → **Expose an API**
-2. Set the Application ID URI (accept the default `api://<client-id>`)
-3. **Add a scope**: value = `access`, admin consent display name = "Access PyRIT GUI",
-   who can consent = "Admins and users", state = Enabled
+In Azure Portal → App registrations → your app → **API permissions**:
 
-Or via CLI:
-```bash
-# Set application ID URI
-APP_OBJ_ID=$(az ad app show --id $APP_ID --query id -o tsv)
-az rest --method PATCH \
-  --url "https://graph.microsoft.com/v1.0/applications/$APP_OBJ_ID" \
-  --body "{\"identifierUris\": [\"api://$APP_ID\"]}"
+1. Select **Add a permission** → **Microsoft Graph** → **Delegated permissions**.
+2. Add `User.Read`.
+3. Grant consent according to your tenant policy. `User.Read` does not normally
+   require admin consent, but some tenants disable user consent.
 
-# Add the 'access' scope (generate a unique GUID for the scope ID)
-SCOPE_ID=$(python3 -c "import uuid; print(uuid.uuid4())")
-az rest --method PATCH \
-  --url "https://graph.microsoft.com/v1.0/applications/$APP_OBJ_ID" \
-  --body "{\"api\":{\"oauth2PermissionScopes\":[{\"id\":\"$SCOPE_ID\",\"isEnabled\":true,\"type\":\"User\",\"value\":\"access\",\"adminConsentDisplayName\":\"Access PyRIT GUI\",\"adminConsentDescription\":\"Allow access to the PyRIT GUI API\",\"userConsentDisplayName\":\"Access PyRIT GUI\",\"userConsentDescription\":\"Allow access to the PyRIT GUI API\"}]}}"
-```
-
-**Configure group claims** for group-based authorization:
+The frontend requests `User.Read`. The backend treats the resulting Graph access
+token as opaque and forwards it only to fixed or allowlisted Graph endpoints. Graph
+validates the token when the backend calls `/me` and `/me/checkMemberGroups`.
 
+Or via CLI:
 ```bash
-# Set groupMembershipClaims to ApplicationGroup (not SecurityGroup — the latter
-# causes groups overage for users in >200 groups, breaking token-based group checks)
+# Add delegated Microsoft Graph User.Read
+# Graph app ID: 00000003-0000-0000-c000-000000000000
+# User.Read delegated permission ID: e1fe6dd8-ba31-4d61-89e7-88639da4683d
+APP_OBJ_ID=$(az ad app show --id $APP_ID --query id -o tsv)
 az rest --method PATCH \
   --url "https://graph.microsoft.com/v1.0/applications/$APP_OBJ_ID" \
-  --body '{"groupMembershipClaims": "ApplicationGroup"}'
+  --body '{"requiredResourceAccess":[{"resourceAppId":"00000003-0000-0000-c000-000000000000","resourceAccess":[{"id":"e1fe6dd8-ba31-4d61-89e7-88639da4683d","type":"Scope"}]}]}'
 ```
 
-Then add `groups` as an optional claim for both ID tokens and access tokens:
-Azure Portal → App registrations → your app → Token configuration → Add optional
-claim → Token type: Access → check `groups` → Save. Repeat for ID token.
-
 ### 3. Entra security groups (required for group-based authorization)
 
 Create one or more security groups for authorized users. Multiple groups can be
@@ -219,8 +211,9 @@ az ad group member add --group "MyApp-Users" --member-id <user-object-id>
 az ad group member list --group "MyApp-Users" --query '[].displayName' -o tsv
 ```
 
-**IMPORTANT: Assign each group to the enterprise application.** This is required for
-`ApplicationGroup` to emit group IDs in tokens:
+**IMPORTANT: Assign each group to the enterprise application.** This enables the
+recommended `appRoleAssignmentRequired` sign-in restriction in addition to the
+backend's Graph-based group authorization:
 
 ```bash
 # Get the service principal (enterprise app) object ID
@@ -237,6 +230,10 @@ az rest --method POST \
 az ad sp update --id $SP_ID --set appRoleAssignmentRequired=true
 ```
 
+Enterprise-app assignment restricts sign-in through this SPA, but a Graph token is
+not client-bound at this backend. The configured allowed groups are therefore the
+backend's authoritative security boundary. Never deploy with an empty group list.
+
 **Nested groups**: Entra enterprise app assignment does **not** cascade to nested
 groups. If group A contains group B as a member, only direct members of A are
 considered assigned. To grant access to members of B, assign B to the enterprise
@@ -244,9 +241,9 @@ app separately and include both group IDs in `allowedGroupObjectIds`.
 
 **App roles** (optional): You can define custom app roles on the app registration
 (e.g., `MyApp.User.All`) and assign groups to specific roles instead of the
-default access role. The backend currently authorizes via the `groups` token claim,
-not `roles`, so app roles serve as organizational metadata and for
-`appRoleAssignmentRequired` gating at the IdP level.
+default access role. The backend authorizes using memberships returned by Graph,
+not token `groups` or `roles` claims, so app roles serve as organizational metadata
+and for `appRoleAssignmentRequired` gating at the IdP level.
 
 ### 4. Azure SQL server with Entra admin (existing)
 
diff --git a/infra/deploy_instance.py b/infra/deploy_instance.py
index 9f6cb1a13a..e038d518ab 100644
--- a/infra/deploy_instance.py
+++ b/infra/deploy_instance.py
@@ -6,7 +6,7 @@
 
 Automates the full deployment of an isolated CoPyRIT GUI instance:
   1. Resource group
-  2. Entra app registration + API scope + group claims
+  2. Entra app registration + delegated Microsoft Graph permission
   3. Entra security group (optional — can use existing)
   4. Azure SQL server + database
   5. Storage account + blob container (auto-injects container URL into .env)
@@ -38,7 +38,6 @@
 import sys
 import tempfile
 import time
-import uuid
 from pathlib import Path
 
 logging.basicConfig(level=logging.INFO, format="%(levelname)s: %(message)s")
@@ -46,6 +45,8 @@
 
 INFRA_DIR = Path(__file__).resolve().parent
 BICEP_TEMPLATE = INFRA_DIR / "main.bicep"
+_MICROSOFT_GRAPH_APP_ID = "00000003-0000-0000-c000-000000000000"
+_GRAPH_USER_READ_SCOPE_ID = "e1fe6dd8-ba31-4d61-89e7-88639da4683d"
 
 # On Windows, az CLI is a .cmd script that requires shell=True for subprocess to find it.
 _SHELL = platform.system() == "Windows"
@@ -125,7 +126,7 @@ def create_resource_group(*, name: str, location: str, tags: list[str] | None =
 
 def create_entra_app(*, display_name: str, service_management_reference: str = "") -> dict:
     """
-    Create an Entra app registration with API scope and group claims.
+    Create an Entra app registration with delegated Microsoft Graph access.
 
     Args:
         display_name (str): The display name for the app registration.
@@ -174,72 +175,19 @@ def create_entra_app(*, display_name: str, service_management_reference: str = "
     )
     sp_id = sp_info["id"]
 
-    # Set Application ID URI
-    logger.info("Setting Application ID URI: api://%s", app_id)
-    run_az(
-        args=[
-            "rest",
-            "--method",
-            "PATCH",
-            "--url",
-            f"https://graph.microsoft.com/v1.0/applications/{app_object_id}",
-            "--body",
-            json.dumps({"identifierUris": [f"api://{app_id}"]}),
-        ]
-    )
-
-    # Add 'access' scope
-    scope_id = str(uuid.uuid4())
-    logger.info("Adding 'access' scope (id: %s)", scope_id)
-    scope_body = {
-        "api": {
-            "oauth2PermissionScopes": [
-                {
-                    "id": scope_id,
-                    "isEnabled": True,
-                    "type": "User",
-                    "value": "access",
-                    "adminConsentDisplayName": "Access PyRIT GUI",
-                    "adminConsentDescription": "Allow access to the PyRIT GUI API",
-                    "userConsentDisplayName": "Access PyRIT GUI",
-                    "userConsentDescription": "Allow access to the PyRIT GUI API",
-                }
-            ]
-        }
-    }
-    run_az(
-        args=[
-            "rest",
-            "--method",
-            "PATCH",
-            "--url",
-            f"https://graph.microsoft.com/v1.0/applications/{app_object_id}",
-            "--body",
-            json.dumps(scope_body),
-        ]
-    )
-
-    # Configure group claims (ApplicationGroup)
-    logger.info("Configuring group claims: ApplicationGroup")
-    run_az(
-        args=[
-            "rest",
-            "--method",
-            "PATCH",
-            "--url",
-            f"https://graph.microsoft.com/v1.0/applications/{app_object_id}",
-            "--body",
-            json.dumps({"groupMembershipClaims": "ApplicationGroup"}),
+    logger.info("Configuring delegated Microsoft Graph User.Read permission")
+    graph_access_body = {
+        "requiredResourceAccess": [
+            {
+                "resourceAppId": _MICROSOFT_GRAPH_APP_ID,
+                "resourceAccess": [
+                    {
+                        "id": _GRAPH_USER_READ_SCOPE_ID,
+                        "type": "Scope",
+                    }
+                ],
+            }
         ]
-    )
-
-    # Configure optional claims (groups in ID and access tokens)
-    logger.info("Adding 'groups' optional claim to ID and access tokens")
-    optional_claims_body = {
-        "optionalClaims": {
-            "idToken": [{"name": "groups", "essential": False}],
-            "accessToken": [{"name": "groups", "essential": False}],
-        }
     }
     run_az(
         args=[
@@ -249,7 +197,7 @@ def create_entra_app(*, display_name: str, service_management_reference: str = "
             "--url",
             f"https://graph.microsoft.com/v1.0/applications/{app_object_id}",
             "--body",
-            json.dumps(optional_claims_body),
+            json.dumps(graph_access_body),
         ]
     )
 
@@ -1213,6 +1161,10 @@ def main(args: list[str] | None = None) -> int:
     entra_app_name = f"CoPyRIT GUI ({instance})"
     group_ids = [g.strip() for g in parsed.allowed_groups.split(",") if g.strip()]
 
+    if not group_ids:
+        logger.error("--allowed-groups must contain at least one Entra group object ID")
+        return 1
+
     # Validate Azure resource name length constraints
     if len(kv_name) > 24:
         logger.error(
@@ -1344,7 +1296,7 @@ def main(args: list[str] | None = None) -> int:
             container_image=parsed.container_image,
             tenant_id=entra["tenant_id"],
             client_id=entra["app_id"],
-            group_ids=parsed.allowed_groups,
+            group_ids=",".join(group_ids),
             sql_server_fqdn=sql["server_fqdn"],
             sql_database_name=sql["database_name"],
             kv_resource_id=kv_id,
diff --git a/infra/main.bicep b/infra/main.bicep
index 2cb33b1cb4..367be3ea92 100644
--- a/infra/main.bicep
+++ b/infra/main.bicep
@@ -3,7 +3,7 @@
 //
 // Deploys the CoPyRIT GUI as an Azure Container App with:
 // - Workload profiles environment with public ingress + optional IP restriction
-// - MSAL PKCE authentication (frontend) + FastAPI JWT middleware (backend)
+// - MSAL PKCE authentication (frontend) + Microsoft Graph-backed auth (backend)
 // - User-assigned managed identity for Azure SQL, ACR, Azure OpenAI, Key Vault
 // - Azure SQL (existing) via managed identity — no passwords
 // - Key Vault for secrets (referenced via ACA secretRef, not embedded)
@@ -50,8 +50,14 @@ param entraClientId string
 
 @description('Object ID of the Entra security group allowed to access the GUI')
 @metadata({ description: 'Find this in Azure Portal → Entra ID → Groups → your group → Object ID' })
+@minLength(1)
 param allowedGroupObjectIds string
 
+var normalizedAllowedGroupObjectIds = filter(
+  map(split(allowedGroupObjectIds, ','), groupId => trim(groupId)),
+  groupId => !empty(groupId)
+)
+
 @description('CIDR range allowed to reach the app (e.g., your corp VPN CIDR). Empty = no IP restriction, all traffic allowed.')
 param allowedCidr string = ''
 
@@ -469,7 +475,7 @@ resource containerApp 'Microsoft.App/containerApps@2024-03-01' = {
             }
             {
               name: 'ENTRA_ALLOWED_GROUP_IDS'
-              value: allowedGroupObjectIds
+              value: join(normalizedAllowedGroupObjectIds, ',')
             }
             // OTel: point the SDK at the ACA managed agent (localhost sidecar)
             {
@@ -509,8 +515,9 @@ resource containerApp 'Microsoft.App/containerApps@2024-03-01' = {
 // certificates on app registrations, making Easy Auth's OAuth authorization
 // code flow impossible. Instead, authentication is handled in-app using
 // MSAL with PKCE (public client flow) — no secrets needed.
-// The frontend uses @azure/msal-browser for login; the backend validates
-// JWTs from the Authorization header against Entra JWKS.
+// The frontend uses @azure/msal-browser to acquire a delegated Microsoft Graph
+// token; the backend validates it through trusted Graph endpoints and applies
+// local group-based authorization.
 // ============================================================================
 
 // ============================================================================
diff --git a/pyrit/backend/main.py b/pyrit/backend/main.py
index 1eb508cf90..7a4ea9828f 100644
--- a/pyrit/backend/main.py
+++ b/pyrit/backend/main.py
@@ -99,8 +99,8 @@ async def lifespan(app: FastAPI) -> AsyncGenerator[None, None]:
 # Attach X-Request-ID to every request/response for log correlation
 app.add_middleware(RequestIdMiddleware)
 
-# Entra ID JWT validation (PKCE — no client secrets needed)
-# Disabled automatically if ENTRA_TENANT_ID / ENTRA_CLIENT_ID are not set
+# Microsoft Graph-backed authentication (PKCE — no client secrets needed)
+# Disabled if tenant/client configuration is absent; enabled deployments require allowed groups.
 app.add_middleware(EntraAuthMiddleware)
 
 
diff --git a/pyrit/backend/middleware/auth.py b/pyrit/backend/middleware/auth.py
index c2c24acd94..8cfe0a0d4c 100644
--- a/pyrit/backend/middleware/auth.py
+++ b/pyrit/backend/middleware/auth.py
@@ -2,28 +2,23 @@
 # Licensed under the MIT license.
 
 """
-Entra ID JWT validation middleware for FastAPI.
+Microsoft Graph-backed authentication middleware for FastAPI.
 
-Validates Bearer tokens from the Authorization header against Entra ID JWKS.
-Uses PKCE (public client) flow — no client secrets needed.
-
-The middleware:
-- Skips auth for health check and auth config endpoints
-- Validates JWT signature against Entra ID's JWKS endpoint
-- Verifies issuer, audience, and expiration
-- Optionally checks group membership (resolves via Graph API if user is in >200 groups)
-- Attaches user info to request.state for use by route handlers
+The frontend acquires a delegated Graph access token using PKCE. This middleware
+forwards that opaque token only to trusted Microsoft Graph endpoints to retrieve
+the current user's identity and group memberships, then applies local group-based
+authorization.
 """
 
 import logging
 import os
+from collections import OrderedDict
 from dataclasses import dataclass
+from hashlib import sha256
+from time import monotonic
 from typing import Any, ClassVar
-from urllib.parse import urlparse
 
 import httpx
-import jwt
-from jwt import PyJWKClient
 from starlette.middleware.base import BaseHTTPMiddleware, RequestResponseEndpoint
 from starlette.requests import Request
 from starlette.responses import JSONResponse, Response
@@ -32,9 +27,19 @@
 logger = logging.getLogger(__name__)
 
 
+class AuthenticationError(Exception):
+    """Expected authentication or authorization failure."""
+
+    def __init__(self, *, status_code: int, detail: str) -> None:
+        """Initialize an authentication failure with its HTTP representation."""
+        super().__init__(detail)
+        self.status_code = status_code
+        self.detail = detail
+
+
 @dataclass
 class AuthenticatedUser:
-    """User identity extracted from a validated JWT."""
+    """User identity returned by Microsoft Graph."""
 
     oid: str
     name: str
@@ -43,7 +48,7 @@ class AuthenticatedUser:
 
 
 class EntraAuthMiddleware(BaseHTTPMiddleware):
-    """Validate Entra ID JWTs on every request (except public paths)."""
+    """Authenticate API requests through Microsoft Graph."""
 
     # Paths that bypass authentication
     _PUBLIC_PATHS: ClassVar[set[str]] = {
@@ -52,32 +57,39 @@ class EntraAuthMiddleware(BaseHTTPMiddleware):
         "/api/media",
     }
 
-    # Hosts the user's Bearer token may be forwarded to
-    _GRAPH_HOSTS: ClassVar[set[str]] = {"graph.microsoft.com"}
-
-    # Trusted URL for resolving group membership; built from a constant (not the
-    # token-supplied endpoint) so token data cannot control the request destination.
-    _GRAPH_MEMBER_OBJECTS_URL: ClassVar[str] = "https://graph.microsoft.com/v1.0/me/getMemberObjects"
+    _GRAPH_ME_URL: ClassVar[str] = "https://graph.microsoft.com/v1.0/me?$select=id,displayName,mail,userPrincipalName"
+    _GRAPH_CHECK_MEMBER_GROUPS_URL: ClassVar[str] = "https://graph.microsoft.com/v1.0/me/checkMemberGroups"
+    _GRAPH_TIMEOUT_SECONDS: ClassVar[float] = 10.0
+    _GRAPH_MAX_GROUP_IDS_PER_REQUEST: ClassVar[int] = 20
+    _AUTH_CACHE_TTL_SECONDS: ClassVar[float] = 60.0
+    _AUTH_CACHE_MAX_ENTRIES: ClassVar[int] = 256
 
     def __init__(self, app: ASGIApp) -> None:
         """Initialize the middleware with Entra ID configuration from environment variables."""
         super().__init__(app)
-        self._tenant_id = os.getenv("ENTRA_TENANT_ID", "")
-        # _client_id is used as the expected JWT audience in _validate_token
-        self._client_id = os.getenv("ENTRA_CLIENT_ID", "")
+        tenant_raw = os.getenv("ENTRA_TENANT_ID", "")
+        client_raw = os.getenv("ENTRA_CLIENT_ID", "")
         groups_raw = os.getenv("ENTRA_ALLOWED_GROUP_IDS", "")
+        self._tenant_id = tenant_raw.strip()
+        self._client_id = client_raw.strip()
         self._allowed_group_ids: set[str] = {g.strip() for g in groups_raw.split(",") if g.strip()}
-        self._enabled = bool(self._tenant_id and self._client_id)
+        self._enabled = any((tenant_raw, client_raw, groups_raw))
+        self._auth_cache: OrderedDict[str, tuple[float, AuthenticatedUser]] = OrderedDict()
 
-        self._jwks_client: PyJWKClient | None
         if self._enabled:
-            jwks_url = f"https://login.microsoftonline.com/{self._tenant_id}/discovery/v2.0/keys"
-            self._jwks_client = PyJWKClient(jwks_url, cache_keys=True)
-            self._issuer = f"https://login.microsoftonline.com/{self._tenant_id}/v2.0"
+            missing_settings = [
+                name
+                for name, value in (
+                    ("ENTRA_TENANT_ID", self._tenant_id),
+                    ("ENTRA_CLIENT_ID", self._client_id),
+                    ("ENTRA_ALLOWED_GROUP_IDS", self._allowed_group_ids),
+                )
+                if not value
+            ]
+            if missing_settings:
+                raise ValueError(f"Incomplete Entra ID configuration: {', '.join(missing_settings)} must be set")
             logger.info("Entra ID auth middleware enabled (tenant=%s)", self._tenant_id)
         else:
-            self._jwks_client = None
-            self._issuer = ""
             logger.warning(
                 "Entra ID auth middleware DISABLED — ENTRA_TENANT_ID or ENTRA_CLIENT_ID not set. "
                 "All requests will be allowed without authentication."
@@ -99,46 +111,39 @@ async def dispatch(self, request: Request, call_next: RequestResponseEndpoint) -
         if not self._enabled or path in self._PUBLIC_PATHS or not path.startswith("/api"):
             return await call_next(request)
 
-        result = await self._authenticate_request_async(request)
-        if isinstance(result, JSONResponse):
-            return result  # Authentication failed with 401 or 403
+        try:
+            user = await self._authenticate_request_async(request)
+        except AuthenticationError as error:
+            return JSONResponse(status_code=error.status_code, content={"detail": error.detail})
 
-        request.state.user = result
+        request.state.user = user
         return await call_next(request)
 
-    async def _authenticate_request_async(self, request: Request) -> AuthenticatedUser | JSONResponse:
+    async def _authenticate_request_async(self, request: Request) -> AuthenticatedUser:
         """
         Extract, validate, and authorize the Bearer token from the request.
 
         Returns:
-            AuthenticatedUser if validation and authorization succeed,
-            JSONResponse with 401 or 403 if they fail.
+            AuthenticatedUser: The authenticated and authorized user.
+
+        Raises:
+            AuthenticationError: If authentication or authorization fails.
         """
-        # Extract Bearer token from Authorization header
         auth_header = request.headers.get("Authorization", "")
-        if not auth_header.startswith("Bearer "):
-            return JSONResponse(
+        auth_parts = auth_header.split()
+        if len(auth_parts) != 2 or auth_parts[0].casefold() != "bearer" or not auth_parts[1]:
+            raise AuthenticationError(
                 status_code=401,
-                content={"detail": "Missing or invalid Authorization header"},
+                detail="Missing or invalid Authorization header",
             )
 
-        token = auth_header.removeprefix("Bearer ")
-
-        # Validate the token and extract user info and claims
-        user, claims = self._validate_token(token)
-        if user is None:
-            return JSONResponse(
-                status_code=401,
-                content={"detail": "Invalid or expired token"},
-            )
+        token = auth_parts[1]
+        cache_key = sha256(token.encode("utf-8")).hexdigest()
+        cached_user = self._get_cached_user(cache_key=cache_key)
+        if cached_user is not None:
+            return cached_user
 
-        # NOTE: This fallback is currently non-functional. The access token's
-        # audience is this app's client ID, but Graph requires tokens with
-        # aud=https://graph.microsoft.com. The call will return 401 and the
-        # user will be denied. This will be resolved when the frontend
-        # migrates from the custom `access` scope to Graph's User.Read scope.
-        if not user.groups and self._allowed_group_ids and "_claim_sources" in claims:
-            user.groups = await self._resolve_excess_groups_async(claims, token)
+        user = await self._authenticate_with_graph_async(token=token)
 
         # Authorize the user based on group membership
         if not self._is_authorized(user):
@@ -149,154 +154,178 @@ async def _authenticate_request_async(self, request: Request) -> AuthenticatedUs
                 user.groups,
                 self._allowed_group_ids,
             )
-            return JSONResponse(
+            raise AuthenticationError(
                 status_code=403,
-                content={"detail": "You are not authorized to access this application"},
+                detail="You are not authorized to access this application",
             )
 
+        self._cache_user(cache_key=cache_key, user=user)
         return user
 
-    def _is_authorized(self, user: AuthenticatedUser) -> bool:
-        """
-        Check if the user is authorized via group membership.
-
-        Authorization passes if:
-        - No group restrictions are configured (open to all authenticated users)
-        - The user's groups intersect with the allowed group IDs
+    def _get_cached_user(self, *, cache_key: str) -> AuthenticatedUser | None:
+        cached = self._auth_cache.get(cache_key)
+        if cached is None:
+            return None
 
-        Returns:
-            True if the user is authorized, False otherwise.
-        """
-        if not self._allowed_group_ids:
-            return True
-        return bool(self._allowed_group_ids & set(user.groups))
+        expires_at, user = cached
+        if expires_at <= monotonic():
+            del self._auth_cache[cache_key]
+            return None
 
-    async def _resolve_excess_groups_async(self, claims: dict[str, Any], token: str) -> list[str]:
-        """
-        Resolve group membership via Microsoft Graph when user is in >200 groups.
+        self._auth_cache.move_to_end(cache_key)
+        return AuthenticatedUser(oid=user.oid, name=user.name, email=user.email, groups=list(user.groups))
 
-        When a user is in >200 groups, Entra ID replaces the `groups` claim with a
-        `_claim_names` / `_claim_sources` overage pointer. This method confirms the
-        overage is present, then calls the Microsoft Graph `getMemberObjects` endpoint
-        to retrieve transitive group memberships, using the user's access token.
+    def _cache_user(self, *, cache_key: str, user: AuthenticatedUser) -> None:
+        cached_user = AuthenticatedUser(oid=user.oid, name=user.name, email=user.email, groups=list(user.groups))
+        self._auth_cache[cache_key] = (monotonic() + self._AUTH_CACHE_TTL_SECONDS, cached_user)
+        self._auth_cache.move_to_end(cache_key)
+        while len(self._auth_cache) > self._AUTH_CACHE_MAX_ENTRIES:
+            self._auth_cache.popitem(last=False)
 
-        The Graph URL is built from a trusted constant (``_GRAPH_MEMBER_OBJECTS_URL``)
-        rather than the token-supplied endpoint, so token data cannot control the
-        request host, path, or port. Pagination links from the Graph response are
-        additionally checked against the Graph allowlist (see ``_is_trusted_graph_url``).
+    async def _authenticate_with_graph_async(self, *, token: str) -> AuthenticatedUser:
+        """
+        Authenticate a delegated access token and retrieve the current user.
 
         Args:
-            claims: The decoded JWT claims containing the group overage pointer.
-            token: The raw Bearer token to forward to Graph API.
+            token (str): The opaque Microsoft Graph access token.
 
         Returns:
-            List of group IDs the user belongs to, or empty list on failure or
-            when no group overage is present.
+            AuthenticatedUser: The user returned by Graph.
+
+        Raises:
+            AuthenticationError: If Graph rejects the token or cannot authenticate the user.
         """
         try:
-            # Entra signals a groups overage via `_claim_names` -> source key -> `_claim_sources`.
-            # We only confirm the overage is present; the endpoint it supplies is intentionally
-            # ignored in favor of a trusted constant so token data cannot control the request.
-            claim_source_key = claims.get("_claim_names", {}).get("groups")
-            if not claim_source_key or claim_source_key not in claims.get("_claim_sources", {}):
-                logger.debug("No group overage claim source found")
-                return []
-
-            endpoint = self._GRAPH_MEMBER_OBJECTS_URL
-
-            all_group_ids: list[str] = []
             async with httpx.AsyncClient() as client:
-                response = await client.post(
-                    endpoint,
-                    headers={
-                        "Authorization": f"Bearer {token}",
-                        "Content-Type": "application/json",
-                    },
-                    json={"securityEnabledOnly": True},
-                    timeout=10.0,
+                profile_response = await client.get(
+                    self._GRAPH_ME_URL,
+                    headers={"Authorization": f"Bearer {token}"},
+                    timeout=self._GRAPH_TIMEOUT_SECONDS,
                 )
-
-                if response.status_code != 200:
-                    logger.warning(
-                        "Group resolution endpoint returned %d: %s",
-                        response.status_code,
-                        response.text[:200],
-                    )
-                    return []
-
-                data = response.json()
-                all_group_ids.extend(data.get("value", []))
-
-                # Handle pagination — Graph may return @odata.nextLink for large results
-                next_link = data.get("@odata.nextLink")
-                while next_link:
-                    if not self._is_trusted_graph_url(next_link):
-                        logger.warning("Refusing to follow untrusted pagination link: %s", next_link)
-                        break
-                    response = await client.get(
-                        next_link,
-                        headers={"Authorization": f"Bearer {token}"},
-                        timeout=10.0,
+                if profile_response.status_code != 200:
+                    raise self._graph_error(
+                        status_code=profile_response.status_code,
+                        operation="user profile lookup",
                     )
-                    if response.status_code != 200:
-                        logger.warning("Group resolution pagination failed at %s: %d", next_link, response.status_code)
-                        break
-                    data = response.json()
-                    all_group_ids.extend(data.get("value", []))
-                    next_link = data.get("@odata.nextLink")
 
-            logger.debug("Group resolution returned %d group memberships", len(all_group_ids))
-            return all_group_ids
+                profile = profile_response.json()
+                if not isinstance(profile, dict):
+                    raise ValueError("Microsoft Graph returned invalid user profile data")
+                user = self._user_from_graph_profile(profile)
+                if user is None:
+                    logger.warning("Microsoft Graph returned an invalid user profile")
+                    raise self._graph_unavailable_error()
+
+                groups = await self._check_group_memberships_async(client=client, token=token)
+                user.groups = groups
 
-        except Exception as e:
-            logger.warning("Failed to resolve group memberships: %s", e)
-            return []
+                return user
+        except (httpx.RequestError, ValueError) as error:
+            logger.warning("Microsoft Graph authentication failed: %s", type(error).__name__)
+            raise self._graph_unavailable_error() from error
 
-    def _is_trusted_graph_url(self, url: str) -> bool:
+    def _is_authorized(self, user: AuthenticatedUser) -> bool:
         """
-        Whether *url* is an HTTPS Microsoft Graph URL safe to forward the token to.
+        Check if the user is authorized via group membership.
 
         Returns:
-            True if *url* uses HTTPS and its host is in the Graph allowlist, False otherwise.
+            True if the user's groups intersect with the allowed group IDs, False otherwise.
         """
-        parsed = urlparse(url)
-        return parsed.scheme == "https" and parsed.hostname in self._GRAPH_HOSTS
+        return bool(self._allowed_group_ids & set(user.groups))
 
-    def _validate_token(self, token: str) -> tuple[AuthenticatedUser | None, dict[str, Any]]:
+    async def _check_group_memberships_async(self, *, client: httpx.AsyncClient, token: str) -> list[str]:
         """
-        Validate a JWT against Entra ID JWKS.
+        Check which allowed groups contain the current user through Graph.
 
         Args:
-            token: The raw JWT string.
+            client (httpx.AsyncClient): The asynchronous Graph HTTP client.
+            token (str): The opaque Graph access token.
 
         Returns:
-            Tuple of (AuthenticatedUser, claims) if valid, (None, {}) if validation fails.
+            list[str]: The allowed group IDs containing the current user.
+
+        Raises:
+            AuthenticationError: If Graph rejects or cannot complete the lookup.
         """
-        try:
-            if self._jwks_client is None:
-                raise RuntimeError("JWKS client not initialized")
-            signing_key = self._jwks_client.get_signing_key_from_jwt(token)
-            claims = jwt.decode(
-                token,
-                signing_key.key,
-                algorithms=["RS256"],
-                audience=self._client_id,
-                issuer=self._issuer,
-                options={"require": ["exp", "iss", "aud", "sub"]},
+        matched_group_ids: list[str] = []
+        allowed_group_ids = sorted(self._allowed_group_ids)
+        for offset in range(0, len(allowed_group_ids), self._GRAPH_MAX_GROUP_IDS_PER_REQUEST):
+            group_ids = allowed_group_ids[offset : offset + self._GRAPH_MAX_GROUP_IDS_PER_REQUEST]
+            response = await client.post(
+                self._GRAPH_CHECK_MEMBER_GROUPS_URL,
+                headers={
+                    "Authorization": f"Bearer {token}",
+                    "Content-Type": "application/json",
+                },
+                json={"groupIds": group_ids},
+                timeout=self._GRAPH_TIMEOUT_SECONDS,
             )
-            user = AuthenticatedUser(
-                oid=claims.get("oid", claims.get("sub", "")),
-                name=claims.get("name", ""),
-                email=claims.get("preferred_username", claims.get("email", "")),
-                groups=claims.get("groups", []),
+            if response.status_code != 200:
+                raise self._graph_error(
+                    status_code=response.status_code,
+                    operation="group membership check",
+                )
+
+            data = response.json()
+            if not isinstance(data, dict):
+                raise ValueError("Microsoft Graph returned invalid group membership data")
+            values = data.get("value")
+            if not isinstance(values, list) or not all(isinstance(value, str) for value in values):
+                raise ValueError("Microsoft Graph returned invalid group membership data")
+            matched_group_ids.extend(values)
+
+        logger.debug("Group membership check matched %d allowed groups", len(matched_group_ids))
+        return matched_group_ids
+
+    def _user_from_graph_profile(self, profile: dict[str, Any]) -> AuthenticatedUser | None:
+        """
+        Convert a Microsoft Graph profile into an authenticated user.
+
+        Args:
+            profile (dict[str, Any]): The response from the Graph ``/me`` endpoint.
+
+        Returns:
+            AuthenticatedUser | None: The authenticated user, or None for invalid data.
+        """
+        oid = profile.get("id")
+        if not isinstance(oid, str) or not oid:
+            return None
+
+        display_name = profile.get("displayName")
+        mail = profile.get("mail")
+        principal_name = profile.get("userPrincipalName")
+        return AuthenticatedUser(
+            oid=oid,
+            name=display_name if isinstance(display_name, str) else "",
+            email=mail if isinstance(mail, str) and mail else principal_name if isinstance(principal_name, str) else "",
+            groups=[],
+        )
+
+    def _graph_error(self, *, status_code: int, operation: str) -> AuthenticationError:
+        """
+        Map a Microsoft Graph failure to an authentication error.
+
+        Returns:
+            AuthenticationError: The mapped authentication or service availability error.
+        """
+        logger.warning("Microsoft Graph %s returned status %d", operation, status_code)
+        if status_code == 401:
+            return AuthenticationError(status_code=401, detail="Invalid or expired token")
+        if status_code == 403:
+            return AuthenticationError(
+                status_code=403,
+                detail="Required Microsoft Graph permission has not been granted",
             )
-            return user, claims
-        except jwt.ExpiredSignatureError:
-            logger.debug("Token expired")
-            return None, {}
-        except jwt.InvalidTokenError as e:
-            logger.debug("Token validation failed: %s", e)
-            return None, {}
-        except Exception as e:
-            logger.warning("Unexpected error during token validation: %s", e)
-            return None, {}
+        return self._graph_unavailable_error()
+
+    def _graph_unavailable_error(self) -> AuthenticationError:
+        """
+        Build an error for an unavailable or malformed Graph service.
+
+        Returns:
+            AuthenticationError: A service unavailable error.
+        """
+        return AuthenticationError(
+            status_code=503,
+            detail="Microsoft Graph is temporarily unavailable",
+        )
diff --git a/tests/unit/backend/test_auth_middleware.py b/tests/unit/backend/test_auth_middleware.py
index fdadc199e5..345d37738b 100644
--- a/tests/unit/backend/test_auth_middleware.py
+++ b/tests/unit/backend/test_auth_middleware.py
@@ -1,117 +1,262 @@
 # Copyright (c) Microsoft Corporation.
 # Licensed under the MIT license.
 
-"""
-Tests for the Entra ID auth middleware.
-"""
+"""Tests for the Entra ID auth middleware."""
 
+import json
 from unittest.mock import AsyncMock, MagicMock, patch
 
+import httpx
 import pytest
+from starlette.responses import JSONResponse
 
-from pyrit.backend.middleware.auth import EntraAuthMiddleware
+from pyrit.backend.middleware.auth import AuthenticatedUser, AuthenticationError, EntraAuthMiddleware
 
 
-def _make_middleware() -> EntraAuthMiddleware:
-    with patch.dict("os.environ", {"ENTRA_TENANT_ID": "", "ENTRA_CLIENT_ID": ""}, clear=False):
+def _make_middleware(*, allowed_group_ids: str = "allowed-group") -> EntraAuthMiddleware:
+    environment = {
+        "ENTRA_TENANT_ID": "test-tenant",
+        "ENTRA_CLIENT_ID": "test-client",
+        "ENTRA_ALLOWED_GROUP_IDS": allowed_group_ids,
+    }
+    with patch.dict("os.environ", environment, clear=False):
         return EntraAuthMiddleware(MagicMock())
 
 
-def test_validate_token_returns_none_when_jwks_client_is_none():
-    """Test that _validate_token returns (None, {}) when _jwks_client is None."""
-    mock_app = MagicMock()
-    with patch.dict(
-        "os.environ",
-        {"ENTRA_TENANT_ID": "", "ENTRA_CLIENT_ID": ""},
-        clear=False,
-    ):
-        middleware = EntraAuthMiddleware(mock_app)
-
-    # Confirm _jwks_client is None (because tenant/client are empty)
-    assert middleware._jwks_client is None
+def _response(*, status_code: int, data: dict[str, object]) -> MagicMock:
+    response = MagicMock(spec=httpx.Response)
+    response.status_code = status_code
+    response.json.return_value = data
+    return response
 
-    user, claims = middleware._validate_token("some.fake.token")
 
-    assert user is None
-    assert claims == {}
+def _client_context(client: AsyncMock) -> MagicMock:
+    context = MagicMock()
+    context.__aenter__ = AsyncMock(return_value=client)
+    context.__aexit__ = AsyncMock(return_value=False)
+    return context
 
 
 @pytest.mark.parametrize(
-    "url, expected",
+    "environment",
     [
-        ("https://graph.microsoft.com/v1.0/me/getMemberObjects", True),
-        ("https://graph.microsoft.com/v1.0/me/memberOf?$skiptoken=abc", True),
-        ("http://graph.microsoft.com/v1.0/me/getMemberObjects", False),  # not https
-        ("https://evil.com/v1.0/me/getMemberObjects", False),  # wrong host
-        ("https://graph.microsoft.com.evil.com/x", False),  # suffix spoof
-        ("https://graph.microsoft.com@evil.com/x", False),  # userinfo spoof
-        ("", False),
+        {"ENTRA_TENANT_ID": "test-tenant", "ENTRA_CLIENT_ID": "", "ENTRA_ALLOWED_GROUP_IDS": ""},
+        {"ENTRA_TENANT_ID": "", "ENTRA_CLIENT_ID": "test-client", "ENTRA_ALLOWED_GROUP_IDS": ""},
+        {"ENTRA_TENANT_ID": "", "ENTRA_CLIENT_ID": "", "ENTRA_ALLOWED_GROUP_IDS": "allowed-group"},
+        {"ENTRA_TENANT_ID": "test-tenant", "ENTRA_CLIENT_ID": "test-client", "ENTRA_ALLOWED_GROUP_IDS": ""},
+        {"ENTRA_TENANT_ID": " ", "ENTRA_CLIENT_ID": " ", "ENTRA_ALLOWED_GROUP_IDS": " , "},
     ],
 )
-def test_is_trusted_graph_url(url, expected):
-    """Only HTTPS Microsoft Graph hosts are trusted to receive the forwarded token."""
-    assert _make_middleware()._is_trusted_graph_url(url) is expected
+def test_init_rejects_incomplete_auth_configuration(environment: dict[str, str]) -> None:
+    with patch.dict("os.environ", environment, clear=False):
+        with pytest.raises(ValueError, match="Incomplete Entra ID configuration"):
+            EntraAuthMiddleware(MagicMock())
+
+
+def test_init_allows_auth_disabled_when_configuration_is_absent() -> None:
+    environment = {"ENTRA_TENANT_ID": "", "ENTRA_CLIENT_ID": "", "ENTRA_ALLOWED_GROUP_IDS": ""}
+
+    with patch.dict("os.environ", environment, clear=False):
+        middleware = EntraAuthMiddleware(MagicMock())
+
+    assert middleware._enabled is False
+
 
+async def test_authenticate_with_graph_resolves_groups_when_restricted() -> None:
+    middleware = _make_middleware(allowed_group_ids="group-1")
+    client = AsyncMock(spec=httpx.AsyncClient)
+    client.get.return_value = _response(
+        status_code=200,
+        data={
+            "id": "user-1",
+            "displayName": "Test User",
+            "mail": None,
+            "userPrincipalName": "test@example.com",
+        },
+    )
+    client.post.return_value = _response(status_code=200, data={"value": ["group-1"]})
 
-async def test_resolve_excess_groups_no_overage_returns_empty():
-    """Claims without a groups overage pointer return [] and make no HTTP request."""
+    with patch("pyrit.backend.middleware.auth.httpx.AsyncClient", return_value=_client_context(client)):
+        result = await middleware._authenticate_with_graph_async(token="graph-token")
+
+    assert isinstance(result, AuthenticatedUser)
+    assert result.email == "test@example.com"
+    assert result.groups == ["group-1"]
+    assert client.post.call_args.args[0] == EntraAuthMiddleware._GRAPH_CHECK_MEMBER_GROUPS_URL
+    assert client.post.call_args.kwargs["json"] == {"groupIds": ["group-1"]}
+
+
+@pytest.mark.parametrize(
+    "graph_status, expected_status",
+    [(401, 401), (403, 403), (429, 503), (500, 503)],
+)
+async def test_authenticate_with_graph_maps_profile_errors(graph_status: int, expected_status: int) -> None:
     middleware = _make_middleware()
-    claims = {"_claim_sources": {"src1": {"endpoint": "https://graph.microsoft.com/x"}}}  # no _claim_names.groups
+    client = AsyncMock(spec=httpx.AsyncClient)
+    client.get.return_value = _response(status_code=graph_status, data={})
 
-    with patch("pyrit.backend.middleware.auth.httpx.AsyncClient") as mock_client:
-        result = await middleware._resolve_excess_groups_async(claims, "the-token")
+    with patch("pyrit.backend.middleware.auth.httpx.AsyncClient", return_value=_client_context(client)):
+        with pytest.raises(AuthenticationError) as error:
+            await middleware._authenticate_with_graph_async(token="graph-token")
 
-    assert result == []
-    mock_client.assert_not_called()
+    assert error.value.status_code == expected_status
 
 
-async def test_resolve_excess_groups_ignores_token_endpoint():
-    """The Graph request uses the trusted constant URL, never the token-supplied endpoint."""
+async def test_authenticate_with_graph_returns_service_unavailable_on_network_error() -> None:
     middleware = _make_middleware()
-    claims = {
-        "_claim_names": {"groups": "src1"},
-        "_claim_sources": {"src1": {"endpoint": "https://evil.com/steal"}},
-    }
+    client = AsyncMock(spec=httpx.AsyncClient)
+    client.get.side_effect = httpx.ConnectError("Graph unavailable")
 
-    mock_response = MagicMock()
-    mock_response.status_code = 200
-    mock_response.json.return_value = {"value": ["group-1", "group-2"]}
+    with patch("pyrit.backend.middleware.auth.httpx.AsyncClient", return_value=_client_context(client)):
+        with pytest.raises(AuthenticationError) as error:
+            await middleware._authenticate_with_graph_async(token="graph-token")
 
-    mock_client = AsyncMock()
-    mock_client.post.return_value = mock_response
-    mock_client_cm = MagicMock()
-    mock_client_cm.__aenter__ = AsyncMock(return_value=mock_client)
-    mock_client_cm.__aexit__ = AsyncMock(return_value=False)
+    assert error.value.status_code == 503
 
-    with patch("pyrit.backend.middleware.auth.httpx.AsyncClient", return_value=mock_client_cm):
-        result = await middleware._resolve_excess_groups_async(claims, "the-token")
 
-    assert result == ["group-1", "group-2"]
-    posted_url = mock_client.post.call_args.args[0]
-    assert posted_url == EntraAuthMiddleware._GRAPH_MEMBER_OBJECTS_URL
-    assert "evil.com" not in posted_url
+async def test_authenticate_with_graph_rejects_non_object_profile() -> None:
+    middleware = _make_middleware()
+    client = AsyncMock(spec=httpx.AsyncClient)
+    client.get.return_value = _response(status_code=200, data={})
+    client.get.return_value.json.return_value = []
+
+    with patch("pyrit.backend.middleware.auth.httpx.AsyncClient", return_value=_client_context(client)):
+        with pytest.raises(AuthenticationError) as error:
+            await middleware._authenticate_with_graph_async(token="graph-token")
+
+    assert error.value.status_code == 503
+
+
+async def test_check_group_memberships_batches_allowed_group_ids() -> None:
+    allowed_group_ids = [f"group-{index:02}" for index in range(21)]
+    middleware = _make_middleware(allowed_group_ids=",".join(reversed(allowed_group_ids)))
+    client = AsyncMock(spec=httpx.AsyncClient)
+    client.post.side_effect = [
+        _response(status_code=200, data={"value": ["group-00"]}),
+        _response(status_code=200, data={"value": ["group-20"]}),
+    ]
+
+    result = await middleware._check_group_memberships_async(client=client, token="graph-token")
+
+    assert result == ["group-00", "group-20"]
+    assert client.post.await_count == 2
+    assert client.post.await_args_list[0].kwargs["json"] == {"groupIds": allowed_group_ids[:20]}
+    assert client.post.await_args_list[1].kwargs["json"] == {"groupIds": allowed_group_ids[20:]}
 
 
-async def test_resolve_excess_groups_stops_on_untrusted_pagination_link():
-    """An untrusted @odata.nextLink halts pagination without issuing the follow-up GET."""
+@pytest.mark.parametrize("graph_status, expected_status", [(401, 401), (403, 403), (429, 503)])
+async def test_check_group_memberships_maps_graph_errors(graph_status: int, expected_status: int) -> None:
     middleware = _make_middleware()
-    claims = {
-        "_claim_names": {"groups": "src1"},
-        "_claim_sources": {"src1": {"endpoint": "https://graph.microsoft.com/x"}},
-    }
+    client = AsyncMock(spec=httpx.AsyncClient)
+    client.post.return_value = _response(status_code=graph_status, data={})
+
+    with pytest.raises(AuthenticationError) as error:
+        await middleware._check_group_memberships_async(client=client, token="graph-token")
+
+    assert error.value.status_code == expected_status
+
+
+async def test_authenticate_with_graph_rejects_non_object_membership_data() -> None:
+    middleware = _make_middleware()
+    client = AsyncMock(spec=httpx.AsyncClient)
+    client.get.return_value = _response(
+        status_code=200,
+        data={"id": "user-1", "displayName": "Test User", "mail": "test@example.com"},
+    )
+    client.post.return_value = _response(status_code=200, data={})
+    client.post.return_value.json.return_value = []
 
-    mock_response = MagicMock()
-    mock_response.status_code = 200
-    mock_response.json.return_value = {"value": ["group-1"], "@odata.nextLink": "https://evil.com/next"}
+    with patch("pyrit.backend.middleware.auth.httpx.AsyncClient", return_value=_client_context(client)):
+        with pytest.raises(AuthenticationError) as error:
+            await middleware._authenticate_with_graph_async(token="graph-token")
 
-    mock_client = AsyncMock()
-    mock_client.post.return_value = mock_response
-    mock_client_cm = MagicMock()
-    mock_client_cm.__aenter__ = AsyncMock(return_value=mock_client)
-    mock_client_cm.__aexit__ = AsyncMock(return_value=False)
+    assert error.value.status_code == 503
+
+
+async def test_authenticate_request_denies_and_does_not_cache_unauthorized_user() -> None:
+    middleware = _make_middleware(allowed_group_ids="allowed-group")
+    request = MagicMock()
+    request.headers = {"Authorization": "Bearer graph-token"}
+    user = AuthenticatedUser(oid="user-1", name="Test User", email="test@example.com", groups=["other-group"])
+
+    with patch.object(
+        middleware,
+        "_authenticate_with_graph_async",
+        new_callable=AsyncMock,
+        return_value=user,
+    ) as authenticate:
+        with pytest.raises(AuthenticationError) as first_error:
+            await middleware._authenticate_request_async(request)
+        with pytest.raises(AuthenticationError):
+            await middleware._authenticate_request_async(request)
+
+    assert first_error.value.status_code == 403
+    assert first_error.value.detail == "You are not authorized to access this application"
+    assert authenticate.await_count == 2
+
+
+async def test_authenticate_request_caches_successful_authorization() -> None:
+    middleware = _make_middleware()
+    request = MagicMock()
+    request.headers = {"Authorization": "bearer graph-token"}
+    user = AuthenticatedUser(oid="user-1", name="Test User", email="test@example.com", groups=["allowed-group"])
+
+    with patch.object(
+        middleware,
+        "_authenticate_with_graph_async",
+        new_callable=AsyncMock,
+        return_value=user,
+    ) as authenticate:
+        first_result = await middleware._authenticate_request_async(request)
+        second_result = await middleware._authenticate_request_async(request)
+
+    assert first_result == user
+    assert second_result == user
+    authenticate.assert_awaited_once_with(token="graph-token")
+
+
+def test_auth_cache_expires_and_evicts_oldest_entry() -> None:
+    middleware = _make_middleware()
+    middleware._AUTH_CACHE_MAX_ENTRIES = 2
+    user = AuthenticatedUser(oid="user-1", name="Test User", email="test@example.com", groups=["allowed-group"])
+
+    with patch("pyrit.backend.middleware.auth.monotonic", return_value=100.0):
+        middleware._cache_user(cache_key="first", user=user)
+        middleware._cache_user(cache_key="second", user=user)
+        middleware._cache_user(cache_key="third", user=user)
+    assert list(middleware._auth_cache) == ["second", "third"]
+
+    with patch("pyrit.backend.middleware.auth.monotonic", return_value=161.0):
+        result = middleware._get_cached_user(cache_key="second")
+
+    assert result is None
+    assert list(middleware._auth_cache) == ["third"]
+
+
+@pytest.mark.parametrize(
+    "authorization",
+    ["", "Bearer", "Bearer ", "Basic token", "Bearer token extra"],
+)
+async def test_authenticate_request_rejects_malformed_authorization_header(authorization: str) -> None:
+    middleware = _make_middleware()
+    request = MagicMock()
+    request.headers = {"Authorization": authorization}
+
+    with pytest.raises(AuthenticationError) as error:
+        await middleware._authenticate_request_async(request)
+
+    assert error.value.status_code == 401
+
+
+async def test_dispatch_maps_authentication_error_to_json_response() -> None:
+    middleware = _make_middleware()
+    request = MagicMock()
+    request.url.path = "/api/targets"
+    error = AuthenticationError(status_code=401, detail="Invalid or expired token")
 
-    with patch("pyrit.backend.middleware.auth.httpx.AsyncClient", return_value=mock_client_cm):
-        result = await middleware._resolve_excess_groups_async(claims, "the-token")
+    with patch.object(middleware, "_authenticate_request_async", new_callable=AsyncMock, side_effect=error):
+        response = await middleware.dispatch(request, AsyncMock())
 
-    assert result == ["group-1"]
-    mock_client.get.assert_not_called()
+    assert isinstance(response, JSONResponse)
+    assert response.status_code == 401
+    assert json.loads(response.body) == {"detail": "Invalid or expired token"}