Prerequisites
To enforce privilege-based access control to your service, you must have a service that’s configured for SSO with XBOX services. This enables the XBOX Secure Token Service (XSTS) to issue tokens that are encrypted with a public key that you provide during configuration. This is referred to as configuring your relying party. For more information, see XBOX services authentication for title services.Implementing privilege-based access control in partner services
The client app must send the XSTS token for the partner service by using the “authorization” header of the HTTP request. After the token is decrypted by the partner service, and the signature of the token verified, the privilege claim must be extracted and verified with the expected privilege for the service. The Game Server sample is a good resource for examples of how to handles XSTS tokens and retrieving the include claims.XBOX services tokens can contain multiple user identities. Each user identity that’s within the token has a privilege claim.