From 0d15e9429ee3c1cda4fc21f605397c598b94fa0d Mon Sep 17 00:00:00 2001
From: Behnam Ousat <behnamousat@microsoft.com>
Date: Mon, 27 Jul 2026 16:00:59 -0700
Subject: [PATCH 1/6] Switch GUI authentication to Microsoft Graph tokens

---
 frontend/src/auth/AuthProvider.test.tsx       |   4 -
 frontend/src/auth/AuthProvider.tsx            |   5 +-
 frontend/src/auth/msalConfig.test.ts          |  26 +-
 frontend/src/auth/msalConfig.ts               |  27 +-
 .../src/components/UserAccountButton.test.tsx |   4 +-
 frontend/src/components/UserAccountButton.tsx |   3 +-
 frontend/src/services/api.ts                  |  11 +-
 infra/DEPLOY_NEW_INSTANCE.md                  |   4 +
 infra/README.md                               |  75 ++--
 infra/deploy_instance.py                      |  92 +---
 infra/main.bicep                              |  16 +-
 pyrit/backend/main.py                         |   4 +-
 pyrit/backend/middleware/auth.py              | 398 ++++++++++--------
 tests/unit/backend/test_auth_middleware.py    | 335 +++++++++++----
 14 files changed, 598 insertions(+), 406 deletions(-)

diff --git a/frontend/src/auth/AuthProvider.test.tsx b/frontend/src/auth/AuthProvider.test.tsx
index e96e138087..add9f91fc0 100644
--- a/frontend/src/auth/AuthProvider.test.tsx
+++ b/frontend/src/auth/AuthProvider.test.tsx
@@ -26,11 +26,8 @@ jest.mock("./msalConfig", () => ({
 }));
 
 const mockSetMsalInstance = jest.fn();
-const mockSetClientId = jest.fn();
-
 jest.mock("../services/api", () => ({
   setMsalInstance: (...args: unknown[]) => mockSetMsalInstance(...args),
-  setClientId: (...args: unknown[]) => mockSetClientId(...args),
 }));
 
 // MSAL browser mocks — PublicClientApplication instance methods
@@ -200,7 +197,6 @@ describe("AuthProvider", () => {
     expect(mockInitialize).toHaveBeenCalled();
     expect(mockHandleRedirectPromise).toHaveBeenCalled();
     expect(mockSetMsalInstance).toHaveBeenCalled();
-    expect(mockSetClientId).toHaveBeenCalledWith("test-client");
   });
 
   // Test 16: handleRedirectPromise returns account → setActiveAccount called
diff --git a/frontend/src/auth/AuthProvider.tsx b/frontend/src/auth/AuthProvider.tsx
index d619d03a48..38ffebdff1 100644
--- a/frontend/src/auth/AuthProvider.tsx
+++ b/frontend/src/auth/AuthProvider.tsx
@@ -24,7 +24,7 @@ import {
 } from '@azure/msal-react'
 import { fetchAuthConfig, buildMsalConfig, buildLoginRequest, type AuthConfig } from './msalConfig'
 import { AuthConfigContext, useAuthConfig } from './AuthConfigContext'
-import { setMsalInstance as setApiMsalInstance, setClientId as setApiClientId } from '../services/api'
+import { setMsalInstance as setApiMsalInstance } from '../services/api'
 
 function LoginRedirect() {
   const { instance } = useMsal()
@@ -35,7 +35,7 @@ function LoginRedirect() {
     // after the login round-trip (see the redirect handling in initMsal).
     instance
       .loginRedirect({
-        ...buildLoginRequest(config.clientId),
+        ...buildLoginRequest(),
         state: window.location.pathname + window.location.search,
       })
       .catch((error) => {
@@ -129,7 +129,6 @@ export function AuthProvider({ children }: AuthProviderProps) {
           // Wire MSAL into the API client BEFORE React re-render,
           // so child components' effects already have the token available.
           setApiMsalInstance(instance)
-          setApiClientId(config.clientId)
           setMsalInstance(instance)
           setAuthConfig(config)
         }
diff --git a/frontend/src/auth/msalConfig.test.ts b/frontend/src/auth/msalConfig.test.ts
index 2e36a518f8..bda21bf5fa 100644
--- a/frontend/src/auth/msalConfig.test.ts
+++ b/frontend/src/auth/msalConfig.test.ts
@@ -4,31 +4,19 @@ jest.mock("@azure/msal-browser", () => ({
   LogLevel: { Warning: 3 },
 }));
 
-import { buildMsalConfig, getApiScopes, buildLoginRequest } from "./msalConfig";
+import { buildMsalConfig, getGraphScopes, buildLoginRequest } from "./msalConfig";
 
 describe("msalConfig", () => {
-  // Tests 1-2: getApiScopes — two branches on the !clientId check (line 75)
-  describe("getApiScopes", () => {
-    it("returns default scopes when clientId is empty", () => {
-      expect(getApiScopes("")).toEqual(["openid", "profile", "email"]);
-    });
-
-    it("returns client-specific scope when clientId is provided", () => {
-      expect(getApiScopes("my-client-id")).toEqual(["api://my-client-id/access"]);
+  describe("getGraphScopes", () => {
+    it("returns the delegated Graph scope", () => {
+      expect(getGraphScopes()).toEqual(["User.Read"]);
     });
   });
 
-  // Tests 3-4: buildLoginRequest — wraps getApiScopes in { scopes }
   describe("buildLoginRequest", () => {
-    it("builds request with client-specific scopes", () => {
-      expect(buildLoginRequest("my-client-id")).toEqual({
-        scopes: ["api://my-client-id/access"],
-      });
-    });
-
-    it("builds request with default scopes when clientId is empty", () => {
-      expect(buildLoginRequest("")).toEqual({
-        scopes: ["openid", "profile", "email"],
+    it("builds request with Graph scopes", () => {
+      expect(buildLoginRequest()).toEqual({
+        scopes: ["User.Read"],
       });
     });
   });
diff --git a/frontend/src/auth/msalConfig.ts b/frontend/src/auth/msalConfig.ts
index fa7d586bce..c63e3a68cf 100644
--- a/frontend/src/auth/msalConfig.ts
+++ b/frontend/src/auth/msalConfig.ts
@@ -8,12 +8,15 @@
  * endpoint (served by the backend from environment variables). This avoids
  * hardcoding tenant-specific values in the frontend bundle.
  *
- * Uses access tokens (not ID tokens) with an API-specific scope so that
- * Entra ID includes the `groups` claim for group-based authorization.
+ * Uses a delegated Microsoft Graph access token. The backend forwards this
+ * token only to trusted Graph endpoints to authenticate the user and resolve
+ * group membership.
  */
 
 import { type Configuration, LogLevel } from '@azure/msal-browser'
 
+const GRAPH_USER_READ_SCOPE = 'User.Read'
+
 export interface AuthConfig {
   clientId: string
   tenantId: string
@@ -54,23 +57,13 @@ export function buildMsalConfig(authConfig: AuthConfig): Configuration {
   }
 }
 
-/**
-  * Build the API scopes for token acquisition.
-  *
-  * Requests the app's custom `access` scope so the resulting access token has
-  * `aud` equal to the app's client ID. The explicit scope name avoids the
-  * `.default` shorthand, which resolves via `requiredResourceAccess` and
-  * triggers mandatory admin consent in the Microsoft corporate tenant.
-  *
-  * The `access` scope is defined under "Expose an API" on the app registration.
-  */
-export function getApiScopes(clientId: string): string[] {
-  if (!clientId) return ['openid', 'profile', 'email']
-  return [`api://${clientId}/access`]
+/** Build the delegated Microsoft Graph scopes used for authentication. */
+export function getGraphScopes(): string[] {
+  return [GRAPH_USER_READ_SCOPE]
 }
 
-export function buildLoginRequest(clientId: string) {
+export function buildLoginRequest(): { scopes: string[] } {
   return {
-    scopes: getApiScopes(clientId),
+    scopes: getGraphScopes(),
   }
 }
diff --git a/frontend/src/components/UserAccountButton.test.tsx b/frontend/src/components/UserAccountButton.test.tsx
index 73035e928d..f0fa8d755f 100644
--- a/frontend/src/components/UserAccountButton.test.tsx
+++ b/frontend/src/components/UserAccountButton.test.tsx
@@ -26,7 +26,7 @@ jest.mock('../auth/AuthConfigContext', () => ({
 }))
 
 jest.mock('../auth/msalConfig', () => ({
-  buildLoginRequest: (clientId: string) => ({ scopes: [`${clientId}/.default`] }),
+  buildLoginRequest: () => ({ scopes: ['User.Read'] }),
 }))
 
 const TestWrapper: React.FC<{ children: React.ReactNode }> = ({ children }) => (
@@ -78,7 +78,7 @@ describe('UserAccountButton', () => {
 
     await user.click(screen.getByRole('button', { name: /log in/i }))
 
-    expect(mockLoginRedirect).toHaveBeenCalledWith({ scopes: ['test-client-id/.default'] })
+    expect(mockLoginRedirect).toHaveBeenCalledWith({ scopes: ['User.Read'] })
   })
 
   it('renders user display name and Sign Out when account exists', () => {
diff --git a/frontend/src/components/UserAccountButton.tsx b/frontend/src/components/UserAccountButton.tsx
index 9d258e6239..4bdc59bdd9 100644
--- a/frontend/src/components/UserAccountButton.tsx
+++ b/frontend/src/components/UserAccountButton.tsx
@@ -19,7 +19,6 @@ import { useUserAccountButtonStyles } from './UserAccountButton.styles'
 function MsalAccountButton() {
   const styles = useUserAccountButtonStyles()
   const { instance, accounts } = useMsal()
-  const config = useAuthConfig()
   const account = instance.getActiveAccount() ?? accounts[0]
 
   if (!account) {
@@ -28,7 +27,7 @@ function MsalAccountButton() {
         <Button
           appearance="subtle"
           icon={<PersonRegular />}
-          onClick={() => instance.loginRedirect(buildLoginRequest(config.clientId)).catch((error) => {
+          onClick={() => instance.loginRedirect(buildLoginRequest()).catch((error) => {
             console.error('Login redirect failed:', error)
           })}
         >
diff --git a/frontend/src/services/api.ts b/frontend/src/services/api.ts
index 5dfb44d8f0..467a7cb158 100644
--- a/frontend/src/services/api.ts
+++ b/frontend/src/services/api.ts
@@ -1,7 +1,7 @@
 import axios from 'axios'
 import { InteractionRequiredAuthError, type PublicClientApplication } from '@azure/msal-browser'
 import { toApiError } from './errors'
-import { getApiScopes } from '../auth/msalConfig'
+import { getGraphScopes } from '../auth/msalConfig'
 import type {
   TargetInstance,
   TargetListResponse,
@@ -55,16 +55,11 @@ function generateRequestId(): string {
 // ---------------------------------------------------------------------------
 
 let _msalInstance: PublicClientApplication | null = null
-let _clientId: string = ''
 
 export function setMsalInstance(instance: PublicClientApplication): void {
   _msalInstance = instance
 }
 
-export function setClientId(clientId: string): void {
-  _clientId = clientId
-}
-
 async function getAccessToken(forceRefresh = false): Promise<string | null> {
   if (!_msalInstance) return null
 
@@ -73,7 +68,7 @@ async function getAccessToken(forceRefresh = false): Promise<string | null> {
 
   try {
     const response = await _msalInstance.acquireTokenSilent({
-      scopes: getApiScopes(_clientId),
+      scopes: getGraphScopes(),
       account,
       forceRefresh,
     })
@@ -81,7 +76,7 @@ async function getAccessToken(forceRefresh = false): Promise<string | null> {
   } catch (error) {
     if (error instanceof InteractionRequiredAuthError) {
       await _msalInstance.acquireTokenRedirect({
-        scopes: getApiScopes(_clientId),
+        scopes: getGraphScopes(),
       })
     }
     return null
diff --git a/infra/DEPLOY_NEW_INSTANCE.md b/infra/DEPLOY_NEW_INSTANCE.md
index b810a928fd..0522a96c78 100644
--- a/infra/DEPLOY_NEW_INSTANCE.md
+++ b/infra/DEPLOY_NEW_INSTANCE.md
@@ -51,6 +51,10 @@ within an instance. The trust boundary is Entra group membership.
 > (script runtime + manual SQL user creation). Plan for this cadence if deploying
 > new instances monthly.
 
+The script configures delegated Microsoft Graph `User.Read`; the backend uses the
+token with `/me` and `/me/getMemberObjects` and requires at least one allowed group.
+See [README.md](README.md#security) for the full authentication model.
+
 ## Quick Deploy
 
 ### 1. Prepare the .env file
diff --git a/infra/README.md b/infra/README.md
index 3c7caca363..65fcd94933 100644
--- a/infra/README.md
+++ b/infra/README.md
@@ -9,9 +9,9 @@ managed identity, security response headers, and no embedded secrets.
 ```
 Users ──→ MSAL PKCE auth ──→ Container App
                                                        ↓
-                                                 MSAL PKCE auth
+                          Graph-backed authentication
                                                        ↓
-                                              FastAPI JWT middleware
+                        Microsoft Graph /me + memberships
                                                        ↓
                                               User-Assigned MI
                                         ↙     ↙     ↓      ↘      ↘
@@ -58,12 +58,16 @@ Production is opt-in via `deployToProd: true`.
 
 - **Authentication**: [MSAL](https://learn.microsoft.com/en-us/entra/msal/)
   [PKCE](https://oauth.net/2/pkce/) on the frontend (`@azure/msal-browser`) +
-  FastAPI JWT middleware on the backend. Validates Bearer tokens against Entra ID
-  JWKS. PKCE (public client) — no client secrets or certificates needed.
+  Microsoft Graph-backed middleware on the backend. The frontend sends a delegated
+  Graph token, and the backend authenticates it through Graph `/me`. PKCE (public
+  client) requires no client secrets or certificates.
 - **Authorization**: Entra group check via `allowedGroupObjectIds` param. Requires
-  `groupMembershipClaims: "ApplicationGroup"` + optional claims + each security group
-  assigned to the enterprise app (see Prerequisites §3). If no group restriction is
-  set, all authenticated users pass.
+  delegated Graph `User.Read`; the backend calls `/me/getMemberObjects` and compares
+  the returned transitive memberships with the configured group IDs. Each security
+  group must also be assigned to the enterprise app (see Prerequisites §3). Authenticated
+  deployments require at least one allowed group and fail to start without one.
+  Successful identity and membership results are cached in-process for 60 seconds by
+  token digest to reduce Graph latency and throttling; bearer tokens are never cached.
 - **Identity**: User-assigned managed identity (UAMI) — created before the container
   app so [RBAC](https://learn.microsoft.com/en-us/azure/role-based-access-control/)
   roles are active before the first revision starts. `AZURE_CLIENT_ID` is set to the
@@ -161,42 +165,30 @@ az account show --query tenantId -o tsv
 >   --spa-redirect-uris "https://$FQDN"
 > ```
 
-**Expose an API scope** (required — the frontend requests `api://{clientId}/access` tokens):
+**Configure delegated Microsoft Graph access** (required):
 
-1. In Azure Portal → App registrations → your app → **Expose an API**
-2. Set the Application ID URI (accept the default `api://<client-id>`)
-3. **Add a scope**: value = `access`, admin consent display name = "Access PyRIT GUI",
-   who can consent = "Admins and users", state = Enabled
+In Azure Portal → App registrations → your app → **API permissions**:
 
-Or via CLI:
-```bash
-# Set application ID URI
-APP_OBJ_ID=$(az ad app show --id $APP_ID --query id -o tsv)
-az rest --method PATCH \
-  --url "https://graph.microsoft.com/v1.0/applications/$APP_OBJ_ID" \
-  --body "{\"identifierUris\": [\"api://$APP_ID\"]}"
+1. Select **Add a permission** → **Microsoft Graph** → **Delegated permissions**.
+2. Add `User.Read`.
+3. Grant consent according to your tenant policy. `User.Read` does not normally
+   require admin consent, but some tenants disable user consent.
 
-# Add the 'access' scope (generate a unique GUID for the scope ID)
-SCOPE_ID=$(python3 -c "import uuid; print(uuid.uuid4())")
-az rest --method PATCH \
-  --url "https://graph.microsoft.com/v1.0/applications/$APP_OBJ_ID" \
-  --body "{\"api\":{\"oauth2PermissionScopes\":[{\"id\":\"$SCOPE_ID\",\"isEnabled\":true,\"type\":\"User\",\"value\":\"access\",\"adminConsentDisplayName\":\"Access PyRIT GUI\",\"adminConsentDescription\":\"Allow access to the PyRIT GUI API\",\"userConsentDisplayName\":\"Access PyRIT GUI\",\"userConsentDescription\":\"Allow access to the PyRIT GUI API\"}]}}"
-```
-
-**Configure group claims** for group-based authorization:
+The frontend requests `User.Read`. The backend treats the resulting Graph access
+token as opaque and forwards it only to fixed or allowlisted Graph endpoints. Graph
+validates the token when the backend calls `/me` and `/me/getMemberObjects`.
 
+Or via CLI:
 ```bash
-# Set groupMembershipClaims to ApplicationGroup (not SecurityGroup — the latter
-# causes groups overage for users in >200 groups, breaking token-based group checks)
+# Add delegated Microsoft Graph User.Read
+# Graph app ID: 00000003-0000-0000-c000-000000000000
+# User.Read delegated permission ID: e1fe6dd8-ba31-4d61-89e7-88639da4683d
+APP_OBJ_ID=$(az ad app show --id $APP_ID --query id -o tsv)
 az rest --method PATCH \
   --url "https://graph.microsoft.com/v1.0/applications/$APP_OBJ_ID" \
-  --body '{"groupMembershipClaims": "ApplicationGroup"}'
+  --body '{"requiredResourceAccess":[{"resourceAppId":"00000003-0000-0000-c000-000000000000","resourceAccess":[{"id":"e1fe6dd8-ba31-4d61-89e7-88639da4683d","type":"Scope"}]}]}'
 ```
 
-Then add `groups` as an optional claim for both ID tokens and access tokens:
-Azure Portal → App registrations → your app → Token configuration → Add optional
-claim → Token type: Access → check `groups` → Save. Repeat for ID token.
-
 ### 3. Entra security groups (required for group-based authorization)
 
 Create one or more security groups for authorized users. Multiple groups can be
@@ -219,8 +211,9 @@ az ad group member add --group "MyApp-Users" --member-id <user-object-id>
 az ad group member list --group "MyApp-Users" --query '[].displayName' -o tsv
 ```
 
-**IMPORTANT: Assign each group to the enterprise application.** This is required for
-`ApplicationGroup` to emit group IDs in tokens:
+**IMPORTANT: Assign each group to the enterprise application.** This enables the
+recommended `appRoleAssignmentRequired` sign-in restriction in addition to the
+backend's Graph-based group authorization:
 
 ```bash
 # Get the service principal (enterprise app) object ID
@@ -237,6 +230,10 @@ az rest --method POST \
 az ad sp update --id $SP_ID --set appRoleAssignmentRequired=true
 ```
 
+Enterprise-app assignment restricts sign-in through this SPA, but a Graph token is
+not client-bound at this backend. The configured allowed groups are therefore the
+backend's authoritative security boundary. Never deploy with an empty group list.
+
 **Nested groups**: Entra enterprise app assignment does **not** cascade to nested
 groups. If group A contains group B as a member, only direct members of A are
 considered assigned. To grant access to members of B, assign B to the enterprise
@@ -244,9 +241,9 @@ app separately and include both group IDs in `allowedGroupObjectIds`.
 
 **App roles** (optional): You can define custom app roles on the app registration
 (e.g., `MyApp.User.All`) and assign groups to specific roles instead of the
-default access role. The backend currently authorizes via the `groups` token claim,
-not `roles`, so app roles serve as organizational metadata and for
-`appRoleAssignmentRequired` gating at the IdP level.
+default access role. The backend authorizes using memberships returned by Graph,
+not token `groups` or `roles` claims, so app roles serve as organizational metadata
+and for `appRoleAssignmentRequired` gating at the IdP level.
 
 ### 4. Azure SQL server with Entra admin (existing)
 
diff --git a/infra/deploy_instance.py b/infra/deploy_instance.py
index 9f6cb1a13a..640cc8b279 100644
--- a/infra/deploy_instance.py
+++ b/infra/deploy_instance.py
@@ -6,7 +6,7 @@
 
 Automates the full deployment of an isolated CoPyRIT GUI instance:
   1. Resource group
-  2. Entra app registration + API scope + group claims
+    2. Entra app registration + delegated Microsoft Graph permission
   3. Entra security group (optional — can use existing)
   4. Azure SQL server + database
   5. Storage account + blob container (auto-injects container URL into .env)
@@ -38,7 +38,6 @@
 import sys
 import tempfile
 import time
-import uuid
 from pathlib import Path
 
 logging.basicConfig(level=logging.INFO, format="%(levelname)s: %(message)s")
@@ -46,6 +45,8 @@
 
 INFRA_DIR = Path(__file__).resolve().parent
 BICEP_TEMPLATE = INFRA_DIR / "main.bicep"
+_MICROSOFT_GRAPH_APP_ID = "00000003-0000-0000-c000-000000000000"
+_GRAPH_USER_READ_SCOPE_ID = "e1fe6dd8-ba31-4d61-89e7-88639da4683d"
 
 # On Windows, az CLI is a .cmd script that requires shell=True for subprocess to find it.
 _SHELL = platform.system() == "Windows"
@@ -125,7 +126,7 @@ def create_resource_group(*, name: str, location: str, tags: list[str] | None =
 
 def create_entra_app(*, display_name: str, service_management_reference: str = "") -> dict:
     """
-    Create an Entra app registration with API scope and group claims.
+    Create an Entra app registration with delegated Microsoft Graph access.
 
     Args:
         display_name (str): The display name for the app registration.
@@ -174,72 +175,19 @@ def create_entra_app(*, display_name: str, service_management_reference: str = "
     )
     sp_id = sp_info["id"]
 
-    # Set Application ID URI
-    logger.info("Setting Application ID URI: api://%s", app_id)
-    run_az(
-        args=[
-            "rest",
-            "--method",
-            "PATCH",
-            "--url",
-            f"https://graph.microsoft.com/v1.0/applications/{app_object_id}",
-            "--body",
-            json.dumps({"identifierUris": [f"api://{app_id}"]}),
-        ]
-    )
-
-    # Add 'access' scope
-    scope_id = str(uuid.uuid4())
-    logger.info("Adding 'access' scope (id: %s)", scope_id)
-    scope_body = {
-        "api": {
-            "oauth2PermissionScopes": [
-                {
-                    "id": scope_id,
-                    "isEnabled": True,
-                    "type": "User",
-                    "value": "access",
-                    "adminConsentDisplayName": "Access PyRIT GUI",
-                    "adminConsentDescription": "Allow access to the PyRIT GUI API",
-                    "userConsentDisplayName": "Access PyRIT GUI",
-                    "userConsentDescription": "Allow access to the PyRIT GUI API",
-                }
-            ]
-        }
-    }
-    run_az(
-        args=[
-            "rest",
-            "--method",
-            "PATCH",
-            "--url",
-            f"https://graph.microsoft.com/v1.0/applications/{app_object_id}",
-            "--body",
-            json.dumps(scope_body),
-        ]
-    )
-
-    # Configure group claims (ApplicationGroup)
-    logger.info("Configuring group claims: ApplicationGroup")
-    run_az(
-        args=[
-            "rest",
-            "--method",
-            "PATCH",
-            "--url",
-            f"https://graph.microsoft.com/v1.0/applications/{app_object_id}",
-            "--body",
-            json.dumps({"groupMembershipClaims": "ApplicationGroup"}),
+    logger.info("Configuring delegated Microsoft Graph User.Read permission")
+    graph_access_body = {
+        "requiredResourceAccess": [
+            {
+                "resourceAppId": _MICROSOFT_GRAPH_APP_ID,
+                "resourceAccess": [
+                    {
+                        "id": _GRAPH_USER_READ_SCOPE_ID,
+                        "type": "Scope",
+                    }
+                ],
+            }
         ]
-    )
-
-    # Configure optional claims (groups in ID and access tokens)
-    logger.info("Adding 'groups' optional claim to ID and access tokens")
-    optional_claims_body = {
-        "optionalClaims": {
-            "idToken": [{"name": "groups", "essential": False}],
-            "accessToken": [{"name": "groups", "essential": False}],
-        }
     }
     run_az(
         args=[
@@ -249,7 +197,7 @@ def create_entra_app(*, display_name: str, service_management_reference: str = "
             "--url",
             f"https://graph.microsoft.com/v1.0/applications/{app_object_id}",
             "--body",
-            json.dumps(optional_claims_body),
+            json.dumps(graph_access_body),
         ]
     )
 
@@ -1213,6 +1161,10 @@ def main(args: list[str] | None = None) -> int:
     entra_app_name = f"CoPyRIT GUI ({instance})"
     group_ids = [g.strip() for g in parsed.allowed_groups.split(",") if g.strip()]
 
+    if not group_ids:
+        logger.error("--allowed-groups must contain at least one Entra group object ID")
+        return 1
+
     # Validate Azure resource name length constraints
     if len(kv_name) > 24:
         logger.error(
@@ -1344,7 +1296,7 @@ def main(args: list[str] | None = None) -> int:
             container_image=parsed.container_image,
             tenant_id=entra["tenant_id"],
             client_id=entra["app_id"],
-            group_ids=parsed.allowed_groups,
+            group_ids=",".join(group_ids),
             sql_server_fqdn=sql["server_fqdn"],
             sql_database_name=sql["database_name"],
             kv_resource_id=kv_id,
diff --git a/infra/main.bicep b/infra/main.bicep
index 2cb33b1cb4..516e3dc0cf 100644
--- a/infra/main.bicep
+++ b/infra/main.bicep
@@ -3,7 +3,7 @@
 //
 // Deploys the CoPyRIT GUI as an Azure Container App with:
 // - Workload profiles environment with public ingress + optional IP restriction
-// - MSAL PKCE authentication (frontend) + FastAPI JWT middleware (backend)
+// - MSAL PKCE authentication (frontend) + Microsoft Graph-backed auth (backend)
 // - User-assigned managed identity for Azure SQL, ACR, Azure OpenAI, Key Vault
 // - Azure SQL (existing) via managed identity — no passwords
 // - Key Vault for secrets (referenced via ACA secretRef, not embedded)
@@ -50,8 +50,15 @@ param entraClientId string
 
 @description('Object ID of the Entra security group allowed to access the GUI')
 @metadata({ description: 'Find this in Azure Portal → Entra ID → Groups → your group → Object ID' })
+@minLength(1)
 param allowedGroupObjectIds string
 
+var normalizedAllowedGroupObjectIds = filter(
+  map(split(allowedGroupObjectIds, ','), groupId => trim(groupId)),
+  groupId => !empty(groupId)
+)
+assert allowedGroupsConfigured = length(normalizedAllowedGroupObjectIds) > 0
+
 @description('CIDR range allowed to reach the app (e.g., your corp VPN CIDR). Empty = no IP restriction, all traffic allowed.')
 param allowedCidr string = ''
 
@@ -469,7 +476,7 @@ resource containerApp 'Microsoft.App/containerApps@2024-03-01' = {
             }
             {
               name: 'ENTRA_ALLOWED_GROUP_IDS'
-              value: allowedGroupObjectIds
+              value: join(normalizedAllowedGroupObjectIds, ',')
             }
             // OTel: point the SDK at the ACA managed agent (localhost sidecar)
             {
@@ -509,8 +516,9 @@ resource containerApp 'Microsoft.App/containerApps@2024-03-01' = {
 // certificates on app registrations, making Easy Auth's OAuth authorization
 // code flow impossible. Instead, authentication is handled in-app using
 // MSAL with PKCE (public client flow) — no secrets needed.
-// The frontend uses @azure/msal-browser for login; the backend validates
-// JWTs from the Authorization header against Entra JWKS.
+// The frontend uses @azure/msal-browser to acquire a delegated Microsoft Graph
+// token; the backend validates it through trusted Graph endpoints and applies
+// local group-based authorization.
 // ============================================================================
 
 // ============================================================================
diff --git a/pyrit/backend/main.py b/pyrit/backend/main.py
index 1eb508cf90..7a4ea9828f 100644
--- a/pyrit/backend/main.py
+++ b/pyrit/backend/main.py
@@ -99,8 +99,8 @@ async def lifespan(app: FastAPI) -> AsyncGenerator[None, None]:
 # Attach X-Request-ID to every request/response for log correlation
 app.add_middleware(RequestIdMiddleware)
 
-# Entra ID JWT validation (PKCE — no client secrets needed)
-# Disabled automatically if ENTRA_TENANT_ID / ENTRA_CLIENT_ID are not set
+# Microsoft Graph-backed authentication (PKCE — no client secrets needed)
+# Disabled if tenant/client configuration is absent; enabled deployments require allowed groups.
 app.add_middleware(EntraAuthMiddleware)
 
 
diff --git a/pyrit/backend/middleware/auth.py b/pyrit/backend/middleware/auth.py
index c2c24acd94..df00080de5 100644
--- a/pyrit/backend/middleware/auth.py
+++ b/pyrit/backend/middleware/auth.py
@@ -2,28 +2,24 @@
 # Licensed under the MIT license.
 
 """
-Entra ID JWT validation middleware for FastAPI.
+Microsoft Graph-backed authentication middleware for FastAPI.
 
-Validates Bearer tokens from the Authorization header against Entra ID JWKS.
-Uses PKCE (public client) flow — no client secrets needed.
-
-The middleware:
-- Skips auth for health check and auth config endpoints
-- Validates JWT signature against Entra ID's JWKS endpoint
-- Verifies issuer, audience, and expiration
-- Optionally checks group membership (resolves via Graph API if user is in >200 groups)
-- Attaches user info to request.state for use by route handlers
+The frontend acquires a delegated Graph access token using PKCE. This middleware
+forwards that opaque token only to trusted Microsoft Graph endpoints to retrieve
+the current user's identity and group memberships, then applies local group-based
+authorization.
 """
 
 import logging
 import os
+from collections import OrderedDict
 from dataclasses import dataclass
+from hashlib import sha256
+from time import monotonic
 from typing import Any, ClassVar
 from urllib.parse import urlparse
 
 import httpx
-import jwt
-from jwt import PyJWKClient
 from starlette.middleware.base import BaseHTTPMiddleware, RequestResponseEndpoint
 from starlette.requests import Request
 from starlette.responses import JSONResponse, Response
@@ -32,9 +28,19 @@
 logger = logging.getLogger(__name__)
 
 
+class AuthenticationError(Exception):
+    """Expected authentication or authorization failure."""
+
+    def __init__(self, *, status_code: int, detail: str) -> None:
+        """Initialize an authentication failure with its HTTP representation."""
+        super().__init__(detail)
+        self.status_code = status_code
+        self.detail = detail
+
+
 @dataclass
 class AuthenticatedUser:
-    """User identity extracted from a validated JWT."""
+    """User identity returned by Microsoft Graph."""
 
     oid: str
     name: str
@@ -43,7 +49,7 @@ class AuthenticatedUser:
 
 
 class EntraAuthMiddleware(BaseHTTPMiddleware):
-    """Validate Entra ID JWTs on every request (except public paths)."""
+    """Authenticate API requests through Microsoft Graph."""
 
     # Paths that bypass authentication
     _PUBLIC_PATHS: ClassVar[set[str]] = {
@@ -57,27 +63,41 @@ class EntraAuthMiddleware(BaseHTTPMiddleware):
 
     # Trusted URL for resolving group membership; built from a constant (not the
     # token-supplied endpoint) so token data cannot control the request destination.
+    _GRAPH_ME_URL: ClassVar[str] = (
+        "https://graph.microsoft.com/v1.0/me?$select=id,displayName,mail,userPrincipalName"
+    )
     _GRAPH_MEMBER_OBJECTS_URL: ClassVar[str] = "https://graph.microsoft.com/v1.0/me/getMemberObjects"
+    _GRAPH_TIMEOUT_SECONDS: ClassVar[float] = 10.0
+    _GRAPH_MAX_MEMBERSHIP_PAGES: ClassVar[int] = 20
+    _AUTH_CACHE_TTL_SECONDS: ClassVar[float] = 60.0
+    _AUTH_CACHE_MAX_ENTRIES: ClassVar[int] = 256
 
     def __init__(self, app: ASGIApp) -> None:
         """Initialize the middleware with Entra ID configuration from environment variables."""
         super().__init__(app)
-        self._tenant_id = os.getenv("ENTRA_TENANT_ID", "")
-        # _client_id is used as the expected JWT audience in _validate_token
-        self._client_id = os.getenv("ENTRA_CLIENT_ID", "")
+        tenant_raw = os.getenv("ENTRA_TENANT_ID", "")
+        client_raw = os.getenv("ENTRA_CLIENT_ID", "")
         groups_raw = os.getenv("ENTRA_ALLOWED_GROUP_IDS", "")
+        self._tenant_id = tenant_raw.strip()
+        self._client_id = client_raw.strip()
         self._allowed_group_ids: set[str] = {g.strip() for g in groups_raw.split(",") if g.strip()}
-        self._enabled = bool(self._tenant_id and self._client_id)
+        self._enabled = any((tenant_raw, client_raw, groups_raw))
+        self._auth_cache: OrderedDict[str, tuple[float, AuthenticatedUser]] = OrderedDict()
 
-        self._jwks_client: PyJWKClient | None
         if self._enabled:
-            jwks_url = f"https://login.microsoftonline.com/{self._tenant_id}/discovery/v2.0/keys"
-            self._jwks_client = PyJWKClient(jwks_url, cache_keys=True)
-            self._issuer = f"https://login.microsoftonline.com/{self._tenant_id}/v2.0"
+            missing_settings = [
+                name
+                for name, value in (
+                    ("ENTRA_TENANT_ID", self._tenant_id),
+                    ("ENTRA_CLIENT_ID", self._client_id),
+                    ("ENTRA_ALLOWED_GROUP_IDS", self._allowed_group_ids),
+                )
+                if not value
+            ]
+            if missing_settings:
+                raise ValueError(f"Incomplete Entra ID configuration: {', '.join(missing_settings)} must be set")
             logger.info("Entra ID auth middleware enabled (tenant=%s)", self._tenant_id)
         else:
-            self._jwks_client = None
-            self._issuer = ""
             logger.warning(
                 "Entra ID auth middleware DISABLED — ENTRA_TENANT_ID or ENTRA_CLIENT_ID not set. "
                 "All requests will be allowed without authentication."
@@ -99,46 +119,39 @@ async def dispatch(self, request: Request, call_next: RequestResponseEndpoint) -
         if not self._enabled or path in self._PUBLIC_PATHS or not path.startswith("/api"):
             return await call_next(request)
 
-        result = await self._authenticate_request_async(request)
-        if isinstance(result, JSONResponse):
-            return result  # Authentication failed with 401 or 403
+        try:
+            user = await self._authenticate_request_async(request)
+        except AuthenticationError as error:
+            return JSONResponse(status_code=error.status_code, content={"detail": error.detail})
 
-        request.state.user = result
+        request.state.user = user
         return await call_next(request)
 
-    async def _authenticate_request_async(self, request: Request) -> AuthenticatedUser | JSONResponse:
+    async def _authenticate_request_async(self, request: Request) -> AuthenticatedUser:
         """
         Extract, validate, and authorize the Bearer token from the request.
 
         Returns:
-            AuthenticatedUser if validation and authorization succeed,
-            JSONResponse with 401 or 403 if they fail.
+            AuthenticatedUser: The authenticated and authorized user.
+
+        Raises:
+            AuthenticationError: If authentication or authorization fails.
         """
-        # Extract Bearer token from Authorization header
         auth_header = request.headers.get("Authorization", "")
-        if not auth_header.startswith("Bearer "):
-            return JSONResponse(
+        auth_parts = auth_header.split()
+        if len(auth_parts) != 2 or auth_parts[0].casefold() != "bearer" or not auth_parts[1]:
+            raise AuthenticationError(
                 status_code=401,
-                content={"detail": "Missing or invalid Authorization header"},
+                detail="Missing or invalid Authorization header",
             )
 
-        token = auth_header.removeprefix("Bearer ")
+        token = auth_parts[1]
+        cache_key = sha256(token.encode("utf-8")).hexdigest()
+        cached_user = self._get_cached_user(cache_key=cache_key)
+        if cached_user is not None:
+            return cached_user
 
-        # Validate the token and extract user info and claims
-        user, claims = self._validate_token(token)
-        if user is None:
-            return JSONResponse(
-                status_code=401,
-                content={"detail": "Invalid or expired token"},
-            )
-
-        # NOTE: This fallback is currently non-functional. The access token's
-        # audience is this app's client ID, but Graph requires tokens with
-        # aud=https://graph.microsoft.com. The call will return 401 and the
-        # user will be denied. This will be resolved when the frontend
-        # migrates from the custom `access` scope to Graph's User.Read scope.
-        if not user.groups and self._allowed_group_ids and "_claim_sources" in claims:
-            user.groups = await self._resolve_excess_groups_async(claims, token)
+        user = await self._authenticate_with_graph_async(token=token)
 
         # Authorize the user based on group membership
         if not self._is_authorized(user):
@@ -149,108 +162,145 @@ async def _authenticate_request_async(self, request: Request) -> AuthenticatedUs
                 user.groups,
                 self._allowed_group_ids,
             )
-            return JSONResponse(
+            raise AuthenticationError(
                 status_code=403,
-                content={"detail": "You are not authorized to access this application"},
+                detail="You are not authorized to access this application",
             )
 
+        self._cache_user(cache_key=cache_key, user=user)
         return user
 
-    def _is_authorized(self, user: AuthenticatedUser) -> bool:
+    def _get_cached_user(self, *, cache_key: str) -> AuthenticatedUser | None:
+        cached = self._auth_cache.get(cache_key)
+        if cached is None:
+            return None
+
+        expires_at, user = cached
+        if expires_at <= monotonic():
+            del self._auth_cache[cache_key]
+            return None
+
+        self._auth_cache.move_to_end(cache_key)
+        return AuthenticatedUser(oid=user.oid, name=user.name, email=user.email, groups=list(user.groups))
+
+    def _cache_user(self, *, cache_key: str, user: AuthenticatedUser) -> None:
+        cached_user = AuthenticatedUser(oid=user.oid, name=user.name, email=user.email, groups=list(user.groups))
+        self._auth_cache[cache_key] = (monotonic() + self._AUTH_CACHE_TTL_SECONDS, cached_user)
+        self._auth_cache.move_to_end(cache_key)
+        while len(self._auth_cache) > self._AUTH_CACHE_MAX_ENTRIES:
+            self._auth_cache.popitem(last=False)
+
+    async def _authenticate_with_graph_async(self, *, token: str) -> AuthenticatedUser:
         """
-        Check if the user is authorized via group membership.
+        Authenticate a delegated access token and retrieve the current user.
 
-        Authorization passes if:
-        - No group restrictions are configured (open to all authenticated users)
-        - The user's groups intersect with the allowed group IDs
+        Args:
+            token (str): The opaque Microsoft Graph access token.
 
         Returns:
-            True if the user is authorized, False otherwise.
-        """
-        if not self._allowed_group_ids:
-            return True
-        return bool(self._allowed_group_ids & set(user.groups))
+            AuthenticatedUser: The user returned by Graph.
 
-    async def _resolve_excess_groups_async(self, claims: dict[str, Any], token: str) -> list[str]:
+        Raises:
+            AuthenticationError: If Graph rejects the token or cannot authenticate the user.
         """
-        Resolve group membership via Microsoft Graph when user is in >200 groups.
+        try:
+            async with httpx.AsyncClient() as client:
+                profile_response = await client.get(
+                    self._GRAPH_ME_URL,
+                    headers={"Authorization": f"Bearer {token}"},
+                    timeout=self._GRAPH_TIMEOUT_SECONDS,
+                )
+                if profile_response.status_code != 200:
+                    raise self._graph_error(
+                        status_code=profile_response.status_code,
+                        operation="user profile lookup",
+                    )
 
-        When a user is in >200 groups, Entra ID replaces the `groups` claim with a
-        `_claim_names` / `_claim_sources` overage pointer. This method confirms the
-        overage is present, then calls the Microsoft Graph `getMemberObjects` endpoint
-        to retrieve transitive group memberships, using the user's access token.
+                profile = profile_response.json()
+                if not isinstance(profile, dict):
+                    raise ValueError("Microsoft Graph returned invalid user profile data")
+                user = self._user_from_graph_profile(profile)
+                if user is None:
+                    logger.warning("Microsoft Graph returned an invalid user profile")
+                    raise self._graph_unavailable_error()
 
-        The Graph URL is built from a trusted constant (``_GRAPH_MEMBER_OBJECTS_URL``)
-        rather than the token-supplied endpoint, so token data cannot control the
-        request host, path, or port. Pagination links from the Graph response are
-        additionally checked against the Graph allowlist (see ``_is_trusted_graph_url``).
+                groups = await self._resolve_group_memberships_async(client=client, token=token)
+                user.groups = groups
 
-        Args:
-            claims: The decoded JWT claims containing the group overage pointer.
-            token: The raw Bearer token to forward to Graph API.
+                return user
+        except (httpx.RequestError, ValueError) as error:
+            logger.warning("Microsoft Graph authentication failed: %s", type(error).__name__)
+            raise self._graph_unavailable_error() from error
+
+    def _is_authorized(self, user: AuthenticatedUser) -> bool:
+        """
+        Check if the user is authorized via group membership.
 
         Returns:
-            List of group IDs the user belongs to, or empty list on failure or
-            when no group overage is present.
+            True if the user's groups intersect with the allowed group IDs, False otherwise.
         """
-        try:
-            # Entra signals a groups overage via `_claim_names` -> source key -> `_claim_sources`.
-            # We only confirm the overage is present; the endpoint it supplies is intentionally
-            # ignored in favor of a trusted constant so token data cannot control the request.
-            claim_source_key = claims.get("_claim_names", {}).get("groups")
-            if not claim_source_key or claim_source_key not in claims.get("_claim_sources", {}):
-                logger.debug("No group overage claim source found")
-                return []
+        return bool(self._allowed_group_ids & set(user.groups))
 
-            endpoint = self._GRAPH_MEMBER_OBJECTS_URL
+    async def _resolve_group_memberships_async(
+        self, *, client: httpx.AsyncClient, token: str
+    ) -> list[str]:
+        """
+        Resolve the current user's transitive group memberships through Graph.
 
-            all_group_ids: list[str] = []
-            async with httpx.AsyncClient() as client:
-                response = await client.post(
-                    endpoint,
-                    headers={
-                        "Authorization": f"Bearer {token}",
-                        "Content-Type": "application/json",
-                    },
-                    json={"securityEnabledOnly": True},
-                    timeout=10.0,
-                )
+        Args:
+            client (httpx.AsyncClient): The asynchronous Graph HTTP client.
+            token (str): The opaque Graph access token.
 
-                if response.status_code != 200:
-                    logger.warning(
-                        "Group resolution endpoint returned %d: %s",
-                        response.status_code,
-                        response.text[:200],
-                    )
-                    return []
-
-                data = response.json()
-                all_group_ids.extend(data.get("value", []))
-
-                # Handle pagination — Graph may return @odata.nextLink for large results
-                next_link = data.get("@odata.nextLink")
-                while next_link:
-                    if not self._is_trusted_graph_url(next_link):
-                        logger.warning("Refusing to follow untrusted pagination link: %s", next_link)
-                        break
-                    response = await client.get(
-                        next_link,
-                        headers={"Authorization": f"Bearer {token}"},
-                        timeout=10.0,
-                    )
-                    if response.status_code != 200:
-                        logger.warning("Group resolution pagination failed at %s: %d", next_link, response.status_code)
-                        break
-                    data = response.json()
-                    all_group_ids.extend(data.get("value", []))
-                    next_link = data.get("@odata.nextLink")
+        Returns:
+            list[str]: The current user's transitive group IDs.
 
-            logger.debug("Group resolution returned %d group memberships", len(all_group_ids))
-            return all_group_ids
+        Raises:
+            AuthenticationError: If Graph rejects or cannot complete the lookup.
+        """
+        response = await client.post(
+            self._GRAPH_MEMBER_OBJECTS_URL,
+            headers={
+                "Authorization": f"Bearer {token}",
+                "Content-Type": "application/json",
+            },
+            json={"securityEnabledOnly": True},
+            timeout=self._GRAPH_TIMEOUT_SECONDS,
+        )
+        group_ids: list[str] = []
+        page_count = 0
+
+        while True:
+            page_count += 1
+            if response.status_code != 200:
+                raise self._graph_error(
+                    status_code=response.status_code,
+                    operation="group membership lookup",
+                )
 
-        except Exception as e:
-            logger.warning("Failed to resolve group memberships: %s", e)
-            return []
+            data = response.json()
+            if not isinstance(data, dict):
+                raise ValueError("Microsoft Graph returned invalid group membership data")
+            values = data.get("value")
+            if not isinstance(values, list) or not all(isinstance(value, str) for value in values):
+                raise ValueError("Microsoft Graph returned invalid group membership data")
+            group_ids.extend(values)
+
+            next_link = data.get("@odata.nextLink")
+            if next_link is None:
+                logger.debug("Group resolution returned %d group memberships", len(group_ids))
+                return group_ids
+            if page_count >= self._GRAPH_MAX_MEMBERSHIP_PAGES:
+                logger.warning("Microsoft Graph group pagination exceeded %d pages", self._GRAPH_MAX_MEMBERSHIP_PAGES)
+                raise self._graph_unavailable_error()
+            if not isinstance(next_link, str) or not self._is_trusted_graph_url(next_link):
+                logger.warning("Microsoft Graph returned an untrusted group pagination link")
+                raise self._graph_unavailable_error()
+
+            response = await client.get(
+                next_link,
+                headers={"Authorization": f"Bearer {token}"},
+                timeout=self._GRAPH_TIMEOUT_SECONDS,
+            )
 
     def _is_trusted_graph_url(self, url: str) -> bool:
         """
@@ -260,43 +310,63 @@ def _is_trusted_graph_url(self, url: str) -> bool:
             True if *url* uses HTTPS and its host is in the Graph allowlist, False otherwise.
         """
         parsed = urlparse(url)
-        return parsed.scheme == "https" and parsed.hostname in self._GRAPH_HOSTS
-
-    def _validate_token(self, token: str) -> tuple[AuthenticatedUser | None, dict[str, Any]]:
+        return (
+            parsed.scheme == "https"
+            and parsed.hostname in self._GRAPH_HOSTS
+            and parsed.username is None
+            and parsed.password is None
+            and parsed.port in {None, 443}
+        )
+
+    def _user_from_graph_profile(self, profile: dict[str, Any]) -> AuthenticatedUser | None:
         """
-        Validate a JWT against Entra ID JWKS.
+        Convert a Microsoft Graph profile into an authenticated user.
 
         Args:
-            token: The raw JWT string.
+            profile (dict[str, Any]): The response from the Graph ``/me`` endpoint.
 
         Returns:
-            Tuple of (AuthenticatedUser, claims) if valid, (None, {}) if validation fails.
+            AuthenticatedUser | None: The authenticated user, or None for invalid data.
         """
-        try:
-            if self._jwks_client is None:
-                raise RuntimeError("JWKS client not initialized")
-            signing_key = self._jwks_client.get_signing_key_from_jwt(token)
-            claims = jwt.decode(
-                token,
-                signing_key.key,
-                algorithms=["RS256"],
-                audience=self._client_id,
-                issuer=self._issuer,
-                options={"require": ["exp", "iss", "aud", "sub"]},
-            )
-            user = AuthenticatedUser(
-                oid=claims.get("oid", claims.get("sub", "")),
-                name=claims.get("name", ""),
-                email=claims.get("preferred_username", claims.get("email", "")),
-                groups=claims.get("groups", []),
+        oid = profile.get("id")
+        if not isinstance(oid, str) or not oid:
+            return None
+
+        display_name = profile.get("displayName")
+        mail = profile.get("mail")
+        principal_name = profile.get("userPrincipalName")
+        return AuthenticatedUser(
+            oid=oid,
+            name=display_name if isinstance(display_name, str) else "",
+            email=mail if isinstance(mail, str) and mail else principal_name if isinstance(principal_name, str) else "",
+            groups=[],
+        )
+
+    def _graph_error(self, *, status_code: int, operation: str) -> AuthenticationError:
+        """
+        Map a Microsoft Graph failure to an authentication error.
+
+        Returns:
+            AuthenticationError: The mapped authentication or service availability error.
+        """
+        logger.warning("Microsoft Graph %s returned status %d", operation, status_code)
+        if status_code == 401:
+            return AuthenticationError(status_code=401, detail="Invalid or expired token")
+        if status_code == 403:
+            return AuthenticationError(
+                status_code=403,
+                detail="Required Microsoft Graph permission has not been granted",
             )
-            return user, claims
-        except jwt.ExpiredSignatureError:
-            logger.debug("Token expired")
-            return None, {}
-        except jwt.InvalidTokenError as e:
-            logger.debug("Token validation failed: %s", e)
-            return None, {}
-        except Exception as e:
-            logger.warning("Unexpected error during token validation: %s", e)
-            return None, {}
+        return self._graph_unavailable_error()
+
+    def _graph_unavailable_error(self) -> AuthenticationError:
+        """
+        Build an error for an unavailable or malformed Graph service.
+
+        Returns:
+            AuthenticationError: A service unavailable error.
+        """
+        return AuthenticationError(
+            status_code=503,
+            detail="Microsoft Graph is temporarily unavailable",
+        )
diff --git a/tests/unit/backend/test_auth_middleware.py b/tests/unit/backend/test_auth_middleware.py
index fdadc199e5..d56297d044 100644
--- a/tests/unit/backend/test_auth_middleware.py
+++ b/tests/unit/backend/test_auth_middleware.py
@@ -1,117 +1,308 @@
 # Copyright (c) Microsoft Corporation.
 # Licensed under the MIT license.
 
-"""
-Tests for the Entra ID auth middleware.
-"""
+"""Tests for the Entra ID auth middleware."""
 
+import json
 from unittest.mock import AsyncMock, MagicMock, patch
 
+import httpx
 import pytest
+from starlette.responses import JSONResponse
 
-from pyrit.backend.middleware.auth import EntraAuthMiddleware
+from pyrit.backend.middleware.auth import AuthenticatedUser, AuthenticationError, EntraAuthMiddleware
 
 
-def _make_middleware() -> EntraAuthMiddleware:
-    with patch.dict("os.environ", {"ENTRA_TENANT_ID": "", "ENTRA_CLIENT_ID": ""}, clear=False):
+def _make_middleware(*, allowed_group_ids: str = "allowed-group") -> EntraAuthMiddleware:
+    environment = {
+        "ENTRA_TENANT_ID": "test-tenant",
+        "ENTRA_CLIENT_ID": "test-client",
+        "ENTRA_ALLOWED_GROUP_IDS": allowed_group_ids,
+    }
+    with patch.dict("os.environ", environment, clear=False):
         return EntraAuthMiddleware(MagicMock())
 
 
-def test_validate_token_returns_none_when_jwks_client_is_none():
-    """Test that _validate_token returns (None, {}) when _jwks_client is None."""
-    mock_app = MagicMock()
-    with patch.dict(
-        "os.environ",
-        {"ENTRA_TENANT_ID": "", "ENTRA_CLIENT_ID": ""},
-        clear=False,
-    ):
-        middleware = EntraAuthMiddleware(mock_app)
+def _response(*, status_code: int, data: dict[str, object]) -> MagicMock:
+    response = MagicMock(spec=httpx.Response)
+    response.status_code = status_code
+    response.json.return_value = data
+    return response
+
+
+def _client_context(client: AsyncMock) -> MagicMock:
+    context = MagicMock()
+    context.__aenter__ = AsyncMock(return_value=client)
+    context.__aexit__ = AsyncMock(return_value=False)
+    return context
+
+
+@pytest.mark.parametrize(
+    "environment",
+    [
+        {"ENTRA_TENANT_ID": "test-tenant", "ENTRA_CLIENT_ID": "", "ENTRA_ALLOWED_GROUP_IDS": ""},
+        {"ENTRA_TENANT_ID": "", "ENTRA_CLIENT_ID": "test-client", "ENTRA_ALLOWED_GROUP_IDS": ""},
+        {"ENTRA_TENANT_ID": "", "ENTRA_CLIENT_ID": "", "ENTRA_ALLOWED_GROUP_IDS": "allowed-group"},
+        {"ENTRA_TENANT_ID": "test-tenant", "ENTRA_CLIENT_ID": "test-client", "ENTRA_ALLOWED_GROUP_IDS": ""},
+        {"ENTRA_TENANT_ID": " ", "ENTRA_CLIENT_ID": " ", "ENTRA_ALLOWED_GROUP_IDS": " , "},
+    ],
+)
+def test_init_rejects_incomplete_auth_configuration(environment: dict[str, str]) -> None:
+    with patch.dict("os.environ", environment, clear=False):
+        with pytest.raises(ValueError, match="Incomplete Entra ID configuration"):
+            EntraAuthMiddleware(MagicMock())
 
-    # Confirm _jwks_client is None (because tenant/client are empty)
-    assert middleware._jwks_client is None
 
-    user, claims = middleware._validate_token("some.fake.token")
+def test_init_allows_auth_disabled_when_configuration_is_absent() -> None:
+    environment = {"ENTRA_TENANT_ID": "", "ENTRA_CLIENT_ID": "", "ENTRA_ALLOWED_GROUP_IDS": ""}
 
-    assert user is None
-    assert claims == {}
+    with patch.dict("os.environ", environment, clear=False):
+        middleware = EntraAuthMiddleware(MagicMock())
+
+    assert middleware._enabled is False
 
 
 @pytest.mark.parametrize(
     "url, expected",
     [
         ("https://graph.microsoft.com/v1.0/me/getMemberObjects", True),
-        ("https://graph.microsoft.com/v1.0/me/memberOf?$skiptoken=abc", True),
-        ("http://graph.microsoft.com/v1.0/me/getMemberObjects", False),  # not https
-        ("https://evil.com/v1.0/me/getMemberObjects", False),  # wrong host
-        ("https://graph.microsoft.com.evil.com/x", False),  # suffix spoof
-        ("https://graph.microsoft.com@evil.com/x", False),  # userinfo spoof
-        ("", False),
+        ("http://graph.microsoft.com/v1.0/me/getMemberObjects", False),
+        ("https://evil.com/v1.0/me/getMemberObjects", False),
+        ("https://user@graph.microsoft.com/x", False),
+        ("https://graph.microsoft.com:444/x", False),
     ],
 )
-def test_is_trusted_graph_url(url, expected):
-    """Only HTTPS Microsoft Graph hosts are trusted to receive the forwarded token."""
+def test_is_trusted_graph_url(url: str, expected: bool) -> None:
     assert _make_middleware()._is_trusted_graph_url(url) is expected
 
 
-async def test_resolve_excess_groups_no_overage_returns_empty():
-    """Claims without a groups overage pointer return [] and make no HTTP request."""
+async def test_authenticate_with_graph_resolves_groups_when_restricted() -> None:
+    middleware = _make_middleware(allowed_group_ids="group-1")
+    client = AsyncMock(spec=httpx.AsyncClient)
+    client.get.return_value = _response(
+        status_code=200,
+        data={
+            "id": "user-1",
+            "displayName": "Test User",
+            "mail": None,
+            "userPrincipalName": "test@example.com",
+        },
+    )
+    client.post.return_value = _response(status_code=200, data={"value": ["group-1", "group-2"]})
+
+    with patch("pyrit.backend.middleware.auth.httpx.AsyncClient", return_value=_client_context(client)):
+        result = await middleware._authenticate_with_graph_async(token="graph-token")
+
+    assert isinstance(result, AuthenticatedUser)
+    assert result.email == "test@example.com"
+    assert result.groups == ["group-1", "group-2"]
+    assert client.post.call_args.args[0] == EntraAuthMiddleware._GRAPH_MEMBER_OBJECTS_URL
+
+
+@pytest.mark.parametrize(
+    "graph_status, expected_status",
+    [(401, 401), (403, 403), (429, 503), (500, 503)],
+)
+async def test_authenticate_with_graph_maps_profile_errors(graph_status: int, expected_status: int) -> None:
     middleware = _make_middleware()
-    claims = {"_claim_sources": {"src1": {"endpoint": "https://graph.microsoft.com/x"}}}  # no _claim_names.groups
+    client = AsyncMock(spec=httpx.AsyncClient)
+    client.get.return_value = _response(status_code=graph_status, data={})
 
-    with patch("pyrit.backend.middleware.auth.httpx.AsyncClient") as mock_client:
-        result = await middleware._resolve_excess_groups_async(claims, "the-token")
+    with patch("pyrit.backend.middleware.auth.httpx.AsyncClient", return_value=_client_context(client)):
+        with pytest.raises(AuthenticationError) as error:
+            await middleware._authenticate_with_graph_async(token="graph-token")
 
-    assert result == []
-    mock_client.assert_not_called()
+    assert error.value.status_code == expected_status
 
 
-async def test_resolve_excess_groups_ignores_token_endpoint():
-    """The Graph request uses the trusted constant URL, never the token-supplied endpoint."""
+async def test_authenticate_with_graph_returns_service_unavailable_on_network_error() -> None:
     middleware = _make_middleware()
-    claims = {
-        "_claim_names": {"groups": "src1"},
-        "_claim_sources": {"src1": {"endpoint": "https://evil.com/steal"}},
-    }
+    client = AsyncMock(spec=httpx.AsyncClient)
+    client.get.side_effect = httpx.ConnectError("Graph unavailable")
 
-    mock_response = MagicMock()
-    mock_response.status_code = 200
-    mock_response.json.return_value = {"value": ["group-1", "group-2"]}
+    with patch("pyrit.backend.middleware.auth.httpx.AsyncClient", return_value=_client_context(client)):
+        with pytest.raises(AuthenticationError) as error:
+            await middleware._authenticate_with_graph_async(token="graph-token")
 
-    mock_client = AsyncMock()
-    mock_client.post.return_value = mock_response
-    mock_client_cm = MagicMock()
-    mock_client_cm.__aenter__ = AsyncMock(return_value=mock_client)
-    mock_client_cm.__aexit__ = AsyncMock(return_value=False)
+    assert error.value.status_code == 503
 
-    with patch("pyrit.backend.middleware.auth.httpx.AsyncClient", return_value=mock_client_cm):
-        result = await middleware._resolve_excess_groups_async(claims, "the-token")
+
+async def test_authenticate_with_graph_rejects_non_object_profile() -> None:
+    middleware = _make_middleware()
+    client = AsyncMock(spec=httpx.AsyncClient)
+    client.get.return_value = _response(status_code=200, data={})
+    client.get.return_value.json.return_value = []
+
+    with patch("pyrit.backend.middleware.auth.httpx.AsyncClient", return_value=_client_context(client)):
+        with pytest.raises(AuthenticationError) as error:
+            await middleware._authenticate_with_graph_async(token="graph-token")
+
+    assert error.value.status_code == 503
+
+
+async def test_resolve_group_memberships_rejects_untrusted_pagination_link() -> None:
+    middleware = _make_middleware(allowed_group_ids="group-1")
+    client = AsyncMock(spec=httpx.AsyncClient)
+    client.post.return_value = _response(
+        status_code=200,
+        data={"value": ["group-1"], "@odata.nextLink": "https://evil.com/next"},
+    )
+
+    with pytest.raises(AuthenticationError) as error:
+        await middleware._resolve_group_memberships_async(client=client, token="graph-token")
+
+    assert error.value.status_code == 503
+    client.get.assert_not_called()
+
+
+async def test_resolve_group_memberships_follows_trusted_pagination_link() -> None:
+    middleware = _make_middleware()
+    client = AsyncMock(spec=httpx.AsyncClient)
+    next_link = "https://graph.microsoft.com/v1.0/me/getMemberObjects?$skiptoken=next"
+    client.post.return_value = _response(
+        status_code=200,
+        data={"value": ["group-1"], "@odata.nextLink": next_link},
+    )
+    client.get.return_value = _response(status_code=200, data={"value": ["group-2"]})
+
+    result = await middleware._resolve_group_memberships_async(client=client, token="graph-token")
 
     assert result == ["group-1", "group-2"]
-    posted_url = mock_client.post.call_args.args[0]
-    assert posted_url == EntraAuthMiddleware._GRAPH_MEMBER_OBJECTS_URL
-    assert "evil.com" not in posted_url
+    assert client.get.call_args.args[0] == next_link
 
 
-async def test_resolve_excess_groups_stops_on_untrusted_pagination_link():
-    """An untrusted @odata.nextLink halts pagination without issuing the follow-up GET."""
+@pytest.mark.parametrize("graph_status, expected_status", [(401, 401), (403, 403), (429, 503)])
+async def test_resolve_group_memberships_maps_graph_errors(graph_status: int, expected_status: int) -> None:
     middleware = _make_middleware()
-    claims = {
-        "_claim_names": {"groups": "src1"},
-        "_claim_sources": {"src1": {"endpoint": "https://graph.microsoft.com/x"}},
-    }
+    client = AsyncMock(spec=httpx.AsyncClient)
+    client.post.return_value = _response(status_code=graph_status, data={})
+
+    with pytest.raises(AuthenticationError) as error:
+        await middleware._resolve_group_memberships_async(client=client, token="graph-token")
 
-    mock_response = MagicMock()
-    mock_response.status_code = 200
-    mock_response.json.return_value = {"value": ["group-1"], "@odata.nextLink": "https://evil.com/next"}
+    assert error.value.status_code == expected_status
 
-    mock_client = AsyncMock()
-    mock_client.post.return_value = mock_response
-    mock_client_cm = MagicMock()
-    mock_client_cm.__aenter__ = AsyncMock(return_value=mock_client)
-    mock_client_cm.__aexit__ = AsyncMock(return_value=False)
 
-    with patch("pyrit.backend.middleware.auth.httpx.AsyncClient", return_value=mock_client_cm):
-        result = await middleware._resolve_excess_groups_async(claims, "the-token")
+async def test_authenticate_with_graph_rejects_non_object_membership_data() -> None:
+    middleware = _make_middleware()
+    client = AsyncMock(spec=httpx.AsyncClient)
+    client.get.return_value = _response(
+        status_code=200,
+        data={"id": "user-1", "displayName": "Test User", "mail": "test@example.com"},
+    )
+    client.post.return_value = _response(status_code=200, data={})
+    client.post.return_value.json.return_value = []
+
+    with patch("pyrit.backend.middleware.auth.httpx.AsyncClient", return_value=_client_context(client)):
+        with pytest.raises(AuthenticationError) as error:
+            await middleware._authenticate_with_graph_async(token="graph-token")
+
+    assert error.value.status_code == 503
+
+
+async def test_resolve_group_memberships_limits_pagination() -> None:
+    middleware = _make_middleware()
+    middleware._GRAPH_MAX_MEMBERSHIP_PAGES = 1
+    client = AsyncMock(spec=httpx.AsyncClient)
+    client.post.return_value = _response(
+        status_code=200,
+        data={
+            "value": ["group-1"],
+            "@odata.nextLink": "https://graph.microsoft.com/v1.0/me/getMemberObjects?$skiptoken=next",
+        },
+    )
+
+    with pytest.raises(AuthenticationError) as error:
+        await middleware._resolve_group_memberships_async(client=client, token="graph-token")
+
+    assert error.value.status_code == 503
+    client.get.assert_not_called()
+
+
+async def test_authenticate_request_denies_and_does_not_cache_unauthorized_user() -> None:
+    middleware = _make_middleware(allowed_group_ids="allowed-group")
+    request = MagicMock()
+    request.headers = {"Authorization": "Bearer graph-token"}
+    user = AuthenticatedUser(oid="user-1", name="Test User", email="test@example.com", groups=["other-group"])
+
+    with patch.object(
+        middleware,
+        "_authenticate_with_graph_async",
+        new_callable=AsyncMock,
+        return_value=user,
+    ) as authenticate:
+        with pytest.raises(AuthenticationError) as first_error:
+            await middleware._authenticate_request_async(request)
+        with pytest.raises(AuthenticationError):
+            await middleware._authenticate_request_async(request)
+
+    assert first_error.value.status_code == 403
+    assert first_error.value.detail == "You are not authorized to access this application"
+    assert authenticate.await_count == 2
+
+
+async def test_authenticate_request_caches_successful_authorization() -> None:
+    middleware = _make_middleware()
+    request = MagicMock()
+    request.headers = {"Authorization": "bearer graph-token"}
+    user = AuthenticatedUser(oid="user-1", name="Test User", email="test@example.com", groups=["allowed-group"])
+
+    with patch.object(
+        middleware,
+        "_authenticate_with_graph_async",
+        new_callable=AsyncMock,
+        return_value=user,
+    ) as authenticate:
+        first_result = await middleware._authenticate_request_async(request)
+        second_result = await middleware._authenticate_request_async(request)
+
+    assert first_result == user
+    assert second_result == user
+    authenticate.assert_awaited_once_with(token="graph-token")
+
+
+def test_auth_cache_expires_and_evicts_oldest_entry() -> None:
+    middleware = _make_middleware()
+    middleware._AUTH_CACHE_MAX_ENTRIES = 2
+    user = AuthenticatedUser(oid="user-1", name="Test User", email="test@example.com", groups=["allowed-group"])
+
+    with patch("pyrit.backend.middleware.auth.monotonic", return_value=100.0):
+        middleware._cache_user(cache_key="first", user=user)
+        middleware._cache_user(cache_key="second", user=user)
+        middleware._cache_user(cache_key="third", user=user)
+    assert list(middleware._auth_cache) == ["second", "third"]
+
+    with patch("pyrit.backend.middleware.auth.monotonic", return_value=161.0):
+        result = middleware._get_cached_user(cache_key="second")
+
+    assert result is None
+    assert list(middleware._auth_cache) == ["third"]
+
+
+@pytest.mark.parametrize(
+    "authorization",
+    ["", "Bearer", "Bearer ", "Basic token", "Bearer token extra"],
+)
+async def test_authenticate_request_rejects_malformed_authorization_header(authorization: str) -> None:
+    middleware = _make_middleware()
+    request = MagicMock()
+    request.headers = {"Authorization": authorization}
+
+    with pytest.raises(AuthenticationError) as error:
+        await middleware._authenticate_request_async(request)
+
+    assert error.value.status_code == 401
+
+
+async def test_dispatch_maps_authentication_error_to_json_response() -> None:
+    middleware = _make_middleware()
+    request = MagicMock()
+    request.url.path = "/api/targets"
+    error = AuthenticationError(status_code=401, detail="Invalid or expired token")
+
+    with patch.object(middleware, "_authenticate_request_async", new_callable=AsyncMock, side_effect=error):
+        response = await middleware.dispatch(request, AsyncMock())
 
-    assert result == ["group-1"]
-    mock_client.get.assert_not_called()
+    assert isinstance(response, JSONResponse)
+    assert response.status_code == 401
+    assert json.loads(response.body) == {"detail": "Invalid or expired token"}

From 0584b4ee82ca20039b6c34d5d2de9050acab50ca Mon Sep 17 00:00:00 2001
From: Behnam Ousat <behnamousat@microsoft.com>
Date: Tue, 28 Jul 2026 09:46:40 -0700
Subject: [PATCH 2/6] ruff

---
 pyrit/backend/middleware/auth.py | 8 ++------
 1 file changed, 2 insertions(+), 6 deletions(-)

diff --git a/pyrit/backend/middleware/auth.py b/pyrit/backend/middleware/auth.py
index df00080de5..6e939e20b1 100644
--- a/pyrit/backend/middleware/auth.py
+++ b/pyrit/backend/middleware/auth.py
@@ -63,9 +63,7 @@ class EntraAuthMiddleware(BaseHTTPMiddleware):
 
     # Trusted URL for resolving group membership; built from a constant (not the
     # token-supplied endpoint) so token data cannot control the request destination.
-    _GRAPH_ME_URL: ClassVar[str] = (
-        "https://graph.microsoft.com/v1.0/me?$select=id,displayName,mail,userPrincipalName"
-    )
+    _GRAPH_ME_URL: ClassVar[str] = "https://graph.microsoft.com/v1.0/me?$select=id,displayName,mail,userPrincipalName"
     _GRAPH_MEMBER_OBJECTS_URL: ClassVar[str] = "https://graph.microsoft.com/v1.0/me/getMemberObjects"
     _GRAPH_TIMEOUT_SECONDS: ClassVar[float] = 10.0
     _GRAPH_MAX_MEMBERSHIP_PAGES: ClassVar[int] = 20
@@ -241,9 +239,7 @@ def _is_authorized(self, user: AuthenticatedUser) -> bool:
         """
         return bool(self._allowed_group_ids & set(user.groups))
 
-    async def _resolve_group_memberships_async(
-        self, *, client: httpx.AsyncClient, token: str
-    ) -> list[str]:
+    async def _resolve_group_memberships_async(self, *, client: httpx.AsyncClient, token: str) -> list[str]:
         """
         Resolve the current user's transitive group memberships through Graph.
 

From 6821fbd0013a19bf80ba97c6cd7794c5f59dff27 Mon Sep 17 00:00:00 2001
From: Behnam Ousat <behnamousat@microsoft.com>
Date: Tue, 28 Jul 2026 10:12:04 -0700
Subject: [PATCH 3/6] better group membership check

---
 pyrit/backend/middleware/auth.py           | 83 ++++++----------------
 tests/unit/backend/test_auth_middleware.py | 82 +++++----------------
 2 files changed, 41 insertions(+), 124 deletions(-)

diff --git a/pyrit/backend/middleware/auth.py b/pyrit/backend/middleware/auth.py
index 6e939e20b1..8cfe0a0d4c 100644
--- a/pyrit/backend/middleware/auth.py
+++ b/pyrit/backend/middleware/auth.py
@@ -17,7 +17,6 @@
 from hashlib import sha256
 from time import monotonic
 from typing import Any, ClassVar
-from urllib.parse import urlparse
 
 import httpx
 from starlette.middleware.base import BaseHTTPMiddleware, RequestResponseEndpoint
@@ -58,15 +57,10 @@ class EntraAuthMiddleware(BaseHTTPMiddleware):
         "/api/media",
     }
 
-    # Hosts the user's Bearer token may be forwarded to
-    _GRAPH_HOSTS: ClassVar[set[str]] = {"graph.microsoft.com"}
-
-    # Trusted URL for resolving group membership; built from a constant (not the
-    # token-supplied endpoint) so token data cannot control the request destination.
     _GRAPH_ME_URL: ClassVar[str] = "https://graph.microsoft.com/v1.0/me?$select=id,displayName,mail,userPrincipalName"
-    _GRAPH_MEMBER_OBJECTS_URL: ClassVar[str] = "https://graph.microsoft.com/v1.0/me/getMemberObjects"
+    _GRAPH_CHECK_MEMBER_GROUPS_URL: ClassVar[str] = "https://graph.microsoft.com/v1.0/me/checkMemberGroups"
     _GRAPH_TIMEOUT_SECONDS: ClassVar[float] = 10.0
-    _GRAPH_MAX_MEMBERSHIP_PAGES: ClassVar[int] = 20
+    _GRAPH_MAX_GROUP_IDS_PER_REQUEST: ClassVar[int] = 20
     _AUTH_CACHE_TTL_SECONDS: ClassVar[float] = 60.0
     _AUTH_CACHE_MAX_ENTRIES: ClassVar[int] = 256
 
@@ -222,7 +216,7 @@ async def _authenticate_with_graph_async(self, *, token: str) -> AuthenticatedUs
                     logger.warning("Microsoft Graph returned an invalid user profile")
                     raise self._graph_unavailable_error()
 
-                groups = await self._resolve_group_memberships_async(client=client, token=token)
+                groups = await self._check_group_memberships_async(client=client, token=token)
                 user.groups = groups
 
                 return user
@@ -239,38 +233,37 @@ def _is_authorized(self, user: AuthenticatedUser) -> bool:
         """
         return bool(self._allowed_group_ids & set(user.groups))
 
-    async def _resolve_group_memberships_async(self, *, client: httpx.AsyncClient, token: str) -> list[str]:
+    async def _check_group_memberships_async(self, *, client: httpx.AsyncClient, token: str) -> list[str]:
         """
-        Resolve the current user's transitive group memberships through Graph.
+        Check which allowed groups contain the current user through Graph.
 
         Args:
             client (httpx.AsyncClient): The asynchronous Graph HTTP client.
             token (str): The opaque Graph access token.
 
         Returns:
-            list[str]: The current user's transitive group IDs.
+            list[str]: The allowed group IDs containing the current user.
 
         Raises:
             AuthenticationError: If Graph rejects or cannot complete the lookup.
         """
-        response = await client.post(
-            self._GRAPH_MEMBER_OBJECTS_URL,
-            headers={
-                "Authorization": f"Bearer {token}",
-                "Content-Type": "application/json",
-            },
-            json={"securityEnabledOnly": True},
-            timeout=self._GRAPH_TIMEOUT_SECONDS,
-        )
-        group_ids: list[str] = []
-        page_count = 0
-
-        while True:
-            page_count += 1
+        matched_group_ids: list[str] = []
+        allowed_group_ids = sorted(self._allowed_group_ids)
+        for offset in range(0, len(allowed_group_ids), self._GRAPH_MAX_GROUP_IDS_PER_REQUEST):
+            group_ids = allowed_group_ids[offset : offset + self._GRAPH_MAX_GROUP_IDS_PER_REQUEST]
+            response = await client.post(
+                self._GRAPH_CHECK_MEMBER_GROUPS_URL,
+                headers={
+                    "Authorization": f"Bearer {token}",
+                    "Content-Type": "application/json",
+                },
+                json={"groupIds": group_ids},
+                timeout=self._GRAPH_TIMEOUT_SECONDS,
+            )
             if response.status_code != 200:
                 raise self._graph_error(
                     status_code=response.status_code,
-                    operation="group membership lookup",
+                    operation="group membership check",
                 )
 
             data = response.json()
@@ -279,40 +272,10 @@ async def _resolve_group_memberships_async(self, *, client: httpx.AsyncClient, t
             values = data.get("value")
             if not isinstance(values, list) or not all(isinstance(value, str) for value in values):
                 raise ValueError("Microsoft Graph returned invalid group membership data")
-            group_ids.extend(values)
-
-            next_link = data.get("@odata.nextLink")
-            if next_link is None:
-                logger.debug("Group resolution returned %d group memberships", len(group_ids))
-                return group_ids
-            if page_count >= self._GRAPH_MAX_MEMBERSHIP_PAGES:
-                logger.warning("Microsoft Graph group pagination exceeded %d pages", self._GRAPH_MAX_MEMBERSHIP_PAGES)
-                raise self._graph_unavailable_error()
-            if not isinstance(next_link, str) or not self._is_trusted_graph_url(next_link):
-                logger.warning("Microsoft Graph returned an untrusted group pagination link")
-                raise self._graph_unavailable_error()
-
-            response = await client.get(
-                next_link,
-                headers={"Authorization": f"Bearer {token}"},
-                timeout=self._GRAPH_TIMEOUT_SECONDS,
-            )
-
-    def _is_trusted_graph_url(self, url: str) -> bool:
-        """
-        Whether *url* is an HTTPS Microsoft Graph URL safe to forward the token to.
+            matched_group_ids.extend(values)
 
-        Returns:
-            True if *url* uses HTTPS and its host is in the Graph allowlist, False otherwise.
-        """
-        parsed = urlparse(url)
-        return (
-            parsed.scheme == "https"
-            and parsed.hostname in self._GRAPH_HOSTS
-            and parsed.username is None
-            and parsed.password is None
-            and parsed.port in {None, 443}
-        )
+        logger.debug("Group membership check matched %d allowed groups", len(matched_group_ids))
+        return matched_group_ids
 
     def _user_from_graph_profile(self, profile: dict[str, Any]) -> AuthenticatedUser | None:
         """
diff --git a/tests/unit/backend/test_auth_middleware.py b/tests/unit/backend/test_auth_middleware.py
index d56297d044..345d37738b 100644
--- a/tests/unit/backend/test_auth_middleware.py
+++ b/tests/unit/backend/test_auth_middleware.py
@@ -62,20 +62,6 @@ def test_init_allows_auth_disabled_when_configuration_is_absent() -> None:
     assert middleware._enabled is False
 
 
-@pytest.mark.parametrize(
-    "url, expected",
-    [
-        ("https://graph.microsoft.com/v1.0/me/getMemberObjects", True),
-        ("http://graph.microsoft.com/v1.0/me/getMemberObjects", False),
-        ("https://evil.com/v1.0/me/getMemberObjects", False),
-        ("https://user@graph.microsoft.com/x", False),
-        ("https://graph.microsoft.com:444/x", False),
-    ],
-)
-def test_is_trusted_graph_url(url: str, expected: bool) -> None:
-    assert _make_middleware()._is_trusted_graph_url(url) is expected
-
-
 async def test_authenticate_with_graph_resolves_groups_when_restricted() -> None:
     middleware = _make_middleware(allowed_group_ids="group-1")
     client = AsyncMock(spec=httpx.AsyncClient)
@@ -88,15 +74,16 @@ async def test_authenticate_with_graph_resolves_groups_when_restricted() -> None
             "userPrincipalName": "test@example.com",
         },
     )
-    client.post.return_value = _response(status_code=200, data={"value": ["group-1", "group-2"]})
+    client.post.return_value = _response(status_code=200, data={"value": ["group-1"]})
 
     with patch("pyrit.backend.middleware.auth.httpx.AsyncClient", return_value=_client_context(client)):
         result = await middleware._authenticate_with_graph_async(token="graph-token")
 
     assert isinstance(result, AuthenticatedUser)
     assert result.email == "test@example.com"
-    assert result.groups == ["group-1", "group-2"]
-    assert client.post.call_args.args[0] == EntraAuthMiddleware._GRAPH_MEMBER_OBJECTS_URL
+    assert result.groups == ["group-1"]
+    assert client.post.call_args.args[0] == EntraAuthMiddleware._GRAPH_CHECK_MEMBER_GROUPS_URL
+    assert client.post.call_args.kwargs["json"] == {"groupIds": ["group-1"]}
 
 
 @pytest.mark.parametrize(
@@ -140,45 +127,31 @@ async def test_authenticate_with_graph_rejects_non_object_profile() -> None:
     assert error.value.status_code == 503
 
 
-async def test_resolve_group_memberships_rejects_untrusted_pagination_link() -> None:
-    middleware = _make_middleware(allowed_group_ids="group-1")
+async def test_check_group_memberships_batches_allowed_group_ids() -> None:
+    allowed_group_ids = [f"group-{index:02}" for index in range(21)]
+    middleware = _make_middleware(allowed_group_ids=",".join(reversed(allowed_group_ids)))
     client = AsyncMock(spec=httpx.AsyncClient)
-    client.post.return_value = _response(
-        status_code=200,
-        data={"value": ["group-1"], "@odata.nextLink": "https://evil.com/next"},
-    )
-
-    with pytest.raises(AuthenticationError) as error:
-        await middleware._resolve_group_memberships_async(client=client, token="graph-token")
+    client.post.side_effect = [
+        _response(status_code=200, data={"value": ["group-00"]}),
+        _response(status_code=200, data={"value": ["group-20"]}),
+    ]
 
-    assert error.value.status_code == 503
-    client.get.assert_not_called()
+    result = await middleware._check_group_memberships_async(client=client, token="graph-token")
 
-
-async def test_resolve_group_memberships_follows_trusted_pagination_link() -> None:
-    middleware = _make_middleware()
-    client = AsyncMock(spec=httpx.AsyncClient)
-    next_link = "https://graph.microsoft.com/v1.0/me/getMemberObjects?$skiptoken=next"
-    client.post.return_value = _response(
-        status_code=200,
-        data={"value": ["group-1"], "@odata.nextLink": next_link},
-    )
-    client.get.return_value = _response(status_code=200, data={"value": ["group-2"]})
-
-    result = await middleware._resolve_group_memberships_async(client=client, token="graph-token")
-
-    assert result == ["group-1", "group-2"]
-    assert client.get.call_args.args[0] == next_link
+    assert result == ["group-00", "group-20"]
+    assert client.post.await_count == 2
+    assert client.post.await_args_list[0].kwargs["json"] == {"groupIds": allowed_group_ids[:20]}
+    assert client.post.await_args_list[1].kwargs["json"] == {"groupIds": allowed_group_ids[20:]}
 
 
 @pytest.mark.parametrize("graph_status, expected_status", [(401, 401), (403, 403), (429, 503)])
-async def test_resolve_group_memberships_maps_graph_errors(graph_status: int, expected_status: int) -> None:
+async def test_check_group_memberships_maps_graph_errors(graph_status: int, expected_status: int) -> None:
     middleware = _make_middleware()
     client = AsyncMock(spec=httpx.AsyncClient)
     client.post.return_value = _response(status_code=graph_status, data={})
 
     with pytest.raises(AuthenticationError) as error:
-        await middleware._resolve_group_memberships_async(client=client, token="graph-token")
+        await middleware._check_group_memberships_async(client=client, token="graph-token")
 
     assert error.value.status_code == expected_status
 
@@ -200,25 +173,6 @@ async def test_authenticate_with_graph_rejects_non_object_membership_data() -> N
     assert error.value.status_code == 503
 
 
-async def test_resolve_group_memberships_limits_pagination() -> None:
-    middleware = _make_middleware()
-    middleware._GRAPH_MAX_MEMBERSHIP_PAGES = 1
-    client = AsyncMock(spec=httpx.AsyncClient)
-    client.post.return_value = _response(
-        status_code=200,
-        data={
-            "value": ["group-1"],
-            "@odata.nextLink": "https://graph.microsoft.com/v1.0/me/getMemberObjects?$skiptoken=next",
-        },
-    )
-
-    with pytest.raises(AuthenticationError) as error:
-        await middleware._resolve_group_memberships_async(client=client, token="graph-token")
-
-    assert error.value.status_code == 503
-    client.get.assert_not_called()
-
-
 async def test_authenticate_request_denies_and_does_not_cache_unauthorized_user() -> None:
     middleware = _make_middleware(allowed_group_ids="allowed-group")
     request = MagicMock()

From 25b3b4b63a9b1925173945cab96f3ba93956a458 Mon Sep 17 00:00:00 2001
From: Behnam Ousat <behnamousat@microsoft.com>
Date: Tue, 28 Jul 2026 10:36:06 -0700
Subject: [PATCH 4/6] better login handling

---
 frontend/src/auth/AuthProvider.test.tsx | 34 ++++++++++-
 frontend/src/auth/AuthProvider.tsx      | 77 ++++++++-----------------
 2 files changed, 55 insertions(+), 56 deletions(-)

diff --git a/frontend/src/auth/AuthProvider.test.tsx b/frontend/src/auth/AuthProvider.test.tsx
index add9f91fc0..337607c012 100644
--- a/frontend/src/auth/AuthProvider.test.tsx
+++ b/frontend/src/auth/AuthProvider.test.tsx
@@ -1,3 +1,4 @@
+import { StrictMode } from "react";
 import { render, screen, waitFor } from "@testing-library/react";
 
 // ---------------------------------------------------------------------------
@@ -75,6 +76,7 @@ jest.mock("@azure/msal-react", () => ({
 }));
 
 import { AuthProvider } from "./AuthProvider";
+import type { AuthConfig } from "./msalConfig";
 
 // ---------------------------------------------------------------------------
 // Tests
@@ -92,8 +94,11 @@ describe("AuthProvider", () => {
   });
 
   // Test 10: fetchAuthConfig never resolves → stuck in loading state
-  it("shows loading state while initializing", () => {
-    mockFetchAuthConfig.mockReturnValue(new Promise(() => {}));
+  it("shows loading state while initializing", async () => {
+    let resolveConfig: (config: AuthConfig) => void = () => {}
+    mockFetchAuthConfig.mockReturnValue(new Promise((resolve) => {
+      resolveConfig = resolve
+    }));
 
     render(
       <AuthProvider>
@@ -102,6 +107,8 @@ describe("AuthProvider", () => {
     );
 
     expect(screen.getByText("Initializing authentication...")).toBeVisible();
+    resolveConfig({ clientId: "", tenantId: "", allowedGroupIds: "" });
+    await screen.findByText("Child");
   });
 
   // Test 11: empty clientId + tenantId → auth disabled, children render directly
@@ -199,6 +206,29 @@ describe("AuthProvider", () => {
     expect(mockSetMsalInstance).toHaveBeenCalled();
   });
 
+  it("handles the redirect once when Strict Mode replays effects", async () => {
+    mockFetchAuthConfig.mockResolvedValue({
+      clientId: "test-client",
+      tenantId: "test-tenant",
+      allowedGroupIds: "g1",
+    });
+
+    render(
+      <StrictMode>
+        <AuthProvider>
+          <div>Child</div>
+        </AuthProvider>
+      </StrictMode>
+    );
+
+    await waitFor(() => {
+      expect(screen.getByTestId("msal-provider")).toBeInTheDocument();
+    });
+    expect(mockHandleRedirectPromise).toHaveBeenCalledTimes(1);
+    expect(mockHandleRedirectPromise).toHaveBeenCalledWith({ navigateToLoginRequestUrl: false });
+    expect(mockLoginRedirect).toHaveBeenCalledTimes(1);
+  });
+
   // Test 16: handleRedirectPromise returns account → setActiveAccount called
   it("sets active account from redirect result", async () => {
     const mockAccount = { username: "user@test.com" };
diff --git a/frontend/src/auth/AuthProvider.tsx b/frontend/src/auth/AuthProvider.tsx
index 38ffebdff1..34577c7b9b 100644
--- a/frontend/src/auth/AuthProvider.tsx
+++ b/frontend/src/auth/AuthProvider.tsx
@@ -10,12 +10,8 @@
  * - Shows a loading state while auth initializes
  */
 
-import { useState, useEffect, type ReactNode } from 'react'
-import {
-  PublicClientApplication,
-  EventType,
-  type AuthenticationResult,
-} from '@azure/msal-browser'
+import { useState, useEffect, useRef, type ReactNode } from 'react'
+import { PublicClientApplication } from '@azure/msal-browser'
 import {
   MsalProvider,
   AuthenticatedTemplate,
@@ -23,14 +19,17 @@ import {
   useMsal,
 } from '@azure/msal-react'
 import { fetchAuthConfig, buildMsalConfig, buildLoginRequest, type AuthConfig } from './msalConfig'
-import { AuthConfigContext, useAuthConfig } from './AuthConfigContext'
+import { AuthConfigContext } from './AuthConfigContext'
 import { setMsalInstance as setApiMsalInstance } from '../services/api'
 
 function LoginRedirect() {
   const { instance } = useMsal()
-  const config = useAuthConfig()
+  const loginStarted = useRef(false)
 
   useEffect(() => {
+    if (loginStarted.current) return
+    loginStarted.current = true
+
     // Capture the path the user originally requested so it can be restored
     // after the login round-trip (see the redirect handling in initMsal).
     instance
@@ -41,7 +40,7 @@ function LoginRedirect() {
       .catch((error) => {
         console.error('Login redirect failed:', error)
       })
-  }, [instance, config])
+  }, [instance])
 
   return <div style={{ padding: '2rem', textAlign: 'center' }}>Redirecting to login...</div>
 }
@@ -67,47 +66,33 @@ export function AuthProvider({ children }: AuthProviderProps) {
   const [authDisabled, setAuthDisabled] = useState(false)
   const [error, setError] = useState<string | null>(null)
   const [authConfig, setAuthConfig] = useState<AuthConfig>({clientId: '', tenantId: '', allowedGroupIds: ''})
+  const initializationStarted = useRef(false)
 
   useEffect(() => {
-    let cancelled = false
+    if (initializationStarted.current) return
+    initializationStarted.current = true
 
     async function initMsal() {
       try {
         const config = await fetchAuthConfig()
+        setAuthConfig(config)
 
-        // If no auth config (local dev), skip MSAL entirely
         if (!config.clientId || !config.tenantId) {
-          if (!cancelled) {
-            setMsalInstance(null) // null signals "auth disabled"
-            setAuthDisabled(true)
-            setAuthConfig(config)
-          }
+          setAuthDisabled(true)
           return
         }
 
-        const msalConfig = buildMsalConfig(config)
-        const instance = new PublicClientApplication(msalConfig)
+        const instance = new PublicClientApplication(buildMsalConfig(config))
         await instance.initialize()
+        const redirectResult = await instance.handleRedirectPromise({ navigateToLoginRequestUrl: false })
 
-        // Handle redirect response (after coming back from login)
-        instance.addEventCallback((event) => {
-          if (event.eventType === EventType.LOGIN_SUCCESS && event.payload) {
-            const result = event.payload as AuthenticationResult
-            instance.setActiveAccount(result.account)
-          }
-        })
-
-        // Await the redirect promise FIRST — on the initial redirect back
-        // from Entra, this caches the token and returns the auth result.
-        // On normal page loads (no redirect hash) it resolves to null.
-        const redirectResult = await instance.handleRedirectPromise()
         if (redirectResult?.account) {
           instance.setActiveAccount(redirectResult.account)
+        } else if (!instance.getActiveAccount()) {
+          const accounts = instance.getAllAccounts()
+          if (accounts.length > 0) instance.setActiveAccount(accounts[0])
         }
 
-        // Restore the deep link the user originally requested, captured as
-        // MSAL state before the login redirect (see LoginRedirect). Only
-        // same-origin paths are honored, guarding against an open redirect.
         const requestedPath = typeof redirectResult?.state === 'string' ? redirectResult.state : null
         if (
           requestedPath &&
@@ -117,32 +102,16 @@ export function AuthProvider({ children }: AuthProviderProps) {
           window.history.replaceState(null, '', requestedPath)
         }
 
-        // Fall back to any cached account from a previous session
-        if (!instance.getActiveAccount()) {
-          const accounts = instance.getAllAccounts()
-          if (accounts.length > 0) {
-            instance.setActiveAccount(accounts[0])
-          }
-        }
-
-        if (!cancelled) {
-          // Wire MSAL into the API client BEFORE React re-render,
-          // so child components' effects already have the token available.
-          setApiMsalInstance(instance)
-          setMsalInstance(instance)
-          setAuthConfig(config)
-        }
+        // Wire MSAL into the API client BEFORE React re-render,
+        // so child components' effects already have the token available.
+        setApiMsalInstance(instance)
+        setMsalInstance(instance)
       } catch (err) {
-        if (!cancelled) {
-          setError(err instanceof Error ? err.message : 'Failed to initialize authentication')
-        }
+        setError(err instanceof Error ? err.message : 'Failed to initialize authentication')
       }
     }
 
     initMsal()
-    return () => {
-      cancelled = true
-    }
   }, [])
 
   if (error) {

From 0d0c5311874375f03791c27ea4d38f31633d04d9 Mon Sep 17 00:00:00 2001
From: Behnam Ousat <behnamousat@microsoft.com>
Date: Wed, 29 Jul 2026 13:26:47 -0700
Subject: [PATCH 5/6] Address authentication PR review feedback

---
 frontend/src/auth/AuthProvider.test.tsx | 2 --
 infra/DEPLOY_NEW_INSTANCE.md            | 2 +-
 infra/README.md                         | 8 ++++----
 infra/main.bicep                        | 1 -
 4 files changed, 5 insertions(+), 8 deletions(-)

diff --git a/frontend/src/auth/AuthProvider.test.tsx b/frontend/src/auth/AuthProvider.test.tsx
index 337607c012..e3023b1e28 100644
--- a/frontend/src/auth/AuthProvider.test.tsx
+++ b/frontend/src/auth/AuthProvider.test.tsx
@@ -37,7 +37,6 @@ const mockHandleRedirectPromise = jest.fn().mockResolvedValue(null);
 const mockGetActiveAccount = jest.fn().mockReturnValue(null);
 const mockGetAllAccounts = jest.fn().mockReturnValue([]);
 const mockSetActiveAccount = jest.fn();
-const mockAddEventCallback = jest.fn();
 const mockLoginRedirect = jest.fn().mockResolvedValue(undefined);
 
 jest.mock("@azure/msal-browser", () => ({
@@ -47,7 +46,6 @@ jest.mock("@azure/msal-browser", () => ({
     getActiveAccount: mockGetActiveAccount,
     getAllAccounts: mockGetAllAccounts,
     setActiveAccount: mockSetActiveAccount,
-    addEventCallback: mockAddEventCallback,
     loginRedirect: mockLoginRedirect,
   })),
   EventType: { LOGIN_SUCCESS: "msal:loginSuccess" },
diff --git a/infra/DEPLOY_NEW_INSTANCE.md b/infra/DEPLOY_NEW_INSTANCE.md
index 0522a96c78..489f557368 100644
--- a/infra/DEPLOY_NEW_INSTANCE.md
+++ b/infra/DEPLOY_NEW_INSTANCE.md
@@ -52,7 +52,7 @@ within an instance. The trust boundary is Entra group membership.
 > new instances monthly.
 
 The script configures delegated Microsoft Graph `User.Read`; the backend uses the
-token with `/me` and `/me/getMemberObjects` and requires at least one allowed group.
+token with `/me` and `/me/checkMemberGroups` and requires at least one allowed group.
 See [README.md](README.md#security) for the full authentication model.
 
 ## Quick Deploy
diff --git a/infra/README.md b/infra/README.md
index 65fcd94933..f4af84d426 100644
--- a/infra/README.md
+++ b/infra/README.md
@@ -9,9 +9,9 @@ managed identity, security response headers, and no embedded secrets.
 ```
 Users ──→ MSAL PKCE auth ──→ Container App
                                                        ↓
-                          Graph-backed authentication
+                                          Graph-backed authentication
                                                        ↓
-                        Microsoft Graph /me + memberships
+                                       Microsoft Graph /me + memberships
                                                        ↓
                                               User-Assigned MI
                                         ↙     ↙     ↓      ↘      ↘
@@ -62,7 +62,7 @@ Production is opt-in via `deployToProd: true`.
   Graph token, and the backend authenticates it through Graph `/me`. PKCE (public
   client) requires no client secrets or certificates.
 - **Authorization**: Entra group check via `allowedGroupObjectIds` param. Requires
-  delegated Graph `User.Read`; the backend calls `/me/getMemberObjects` and compares
+  delegated Graph `User.Read`; the backend calls `/me/checkMemberGroups` and compares
   the returned transitive memberships with the configured group IDs. Each security
   group must also be assigned to the enterprise app (see Prerequisites §3). Authenticated
   deployments require at least one allowed group and fail to start without one.
@@ -176,7 +176,7 @@ In Azure Portal → App registrations → your app → **API permissions**:
 
 The frontend requests `User.Read`. The backend treats the resulting Graph access
 token as opaque and forwards it only to fixed or allowlisted Graph endpoints. Graph
-validates the token when the backend calls `/me` and `/me/getMemberObjects`.
+validates the token when the backend calls `/me` and `/me/checkMemberGroups`.
 
 Or via CLI:
 ```bash
diff --git a/infra/main.bicep b/infra/main.bicep
index 516e3dc0cf..367be3ea92 100644
--- a/infra/main.bicep
+++ b/infra/main.bicep
@@ -57,7 +57,6 @@ var normalizedAllowedGroupObjectIds = filter(
   map(split(allowedGroupObjectIds, ','), groupId => trim(groupId)),
   groupId => !empty(groupId)
 )
-assert allowedGroupsConfigured = length(normalizedAllowedGroupObjectIds) > 0
 
 @description('CIDR range allowed to reach the app (e.g., your corp VPN CIDR). Empty = no IP restriction, all traffic allowed.')
 param allowedCidr string = ''

From 84bd9ac19a2dce4519ea9638301e2bead2b44476 Mon Sep 17 00:00:00 2001
From: Behnam Ousat <behnamousat@microsoft.com>
Date: Thu, 30 Jul 2026 12:13:19 -0700
Subject: [PATCH 6/6] fix indent size

---
 infra/deploy_instance.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/infra/deploy_instance.py b/infra/deploy_instance.py
index 640cc8b279..e038d518ab 100644
--- a/infra/deploy_instance.py
+++ b/infra/deploy_instance.py
@@ -6,7 +6,7 @@
 
 Automates the full deployment of an isolated CoPyRIT GUI instance:
   1. Resource group
-    2. Entra app registration + delegated Microsoft Graph permission
+  2. Entra app registration + delegated Microsoft Graph permission
   3. Entra security group (optional — can use existing)
   4. Azure SQL server + database
   5. Storage account + blob container (auto-injects container URL into .env)