Identity Server + Azure Active Directory + Blazor problem with role claim

I managed to use Identity Server with blazor, and to set and use different user claims like role for local databases users (blocking page access etc.). Then I added AAD connection successfully but not all claims are trasmitted to the blazor app in the id_token. I don't think it's a Blazor concern, but more a IS4 and AAD configuration issue.

Here is my IS4 startup.cs setup:

  //AAD
        services.AddAuthentication()
            .AddOpenIdConnect("aad", "Sign-in with Azure AD", options =>
            {
                options.Authority = "https://login.microsoftonline.com/common";
                options.ClientId = "xxxxxxxxxxxxxxxxxxxxxxxxxxxxx";

                options.SignInScheme = IdentityServerConstants.ExternalCookieAuthenticationScheme;
                options.SignOutScheme = IdentityServerConstants.SignoutScheme;
                options.ResponseType = "id_token";



                options.CallbackPath = "/signin-aad";
                options.SignedOutCallbackPath = "/signout-callback-aad";
                options.RemoteSignOutPath = "/signout-aad";

                options.TokenValidationParameters = new TokenValidationParameters
                {
                    ValidateIssuer = false,
                    NameClaimType = "name",
                    RoleClaimType = "role"
                };
            });

        // preserve OIDC state in cache (solves problems with AAD and URL lenghts)
        services.AddOidcStateDataFormatterCache("aad");
        //

My client configuration in config.cs:

  new Client
                {
                    ClientId = "blazor",
                    AllowedGrantTypes = GrantTypes.Code,
                    RequirePkce = true,
                    RequireClientSecret = false,
                    AllowedCorsOrigins = { "https://localhost:5001" },
                    AllowedScopes = { "openid", "profile", "email","backend" },
                    AlwaysIncludeUserClaimsInIdToken=true,
                    RedirectUris = { "https://localhost:5001/authentication/login-callback" },
                    PostLogoutRedirectUris = { "https://localhost:5001/" },
                    Enabled = true
                },   

Identity console logs:

[10:56:36 Debug] IdentityServer4.ResponseHandling.UserInfoResponseGenerator
Scopes in access token: openid profile backend email

[10:56:36 Debug] IdentityServer4.ResponseHandling.UserInfoResponseGenerator
Requested claim types: sub name family_name given_name middle_name nickname preferred_username profile picture website gender birthdate zoneinfo locale updated_at role email email_verified

[10:56:36 Information] IdentityServer4.ResponseHandling.UserInfoResponseGenerator
Profile service returned the following claim types: sub name preferred_username

And the id_token claims:

s_hash: 34563456345634563563
sid: wretqert3545643563456
sub: GUID
auth_time: 2342424324
idp: aad
name: bob Henri
preferred_username: GUID
amr: external

I want all the requested claims to appear here.

Thanks in advance