How to add role claims to AzureAD token for Managed Identity?

Question

The role assignments claims aren't coming through on receiving a token from AzureAD in our tenant for managed identities.

Here's an example of a token returned by AzureAD for the client id of an app registration:

Here's the token returned by AzureAD for a managed identity that has a role assigned to it (the role claims are not present):

The token from the managed identity has all the same properties except the roles. I can see in azure that the managed identity has a role assignment, but it is not returning in the token. Any advice?

I'm expecting the role assignments assigned to the Managed Identity to be returned in the AzureAD token.