NOTE: on-premises customers do not need to follow this instructions.

1. Make sure you are using ver. 1.1.3.0 or up of Extensions.
2. When the app is uploaded to the catalog, it will register a request to have Read access to your Azure Active Directory. It needs this permission to be able to read group memberships.
3. A Global Administrator needs to approve the request:
   1. Click on the waffle menu in the top left corner, then click on the Admin app
   2. Under Admin centers in the left menu, click on SharePoint
   3. If you are still using the classic admin center, switch to the Modern preview. There is no option to approve the request in the classic UI.
   4. On the left menu click on API management under Advanced
      
   5.  This needs to be done only once per tenant.

You are now ready to use Azure AD groups in your rules.