Azure Active Directory issues bearer tokens with embedded claims: group membership, role assignments, conditional access evaluation state. At each service boundary, the receiving component validates the cryptographic signature and checks the expiration timestamp. It does not re-query group membership against the directory. It does not re-evaluate conditional access policy against current device or