I'm planning to build a SharePoint Online environment using the SharePoint Framework, and there is quite a bit of complex business logic that will exist in an external .NET Web API. Due to a variety of reasons, I don't plan to make use of SharePoint lists as much as your average SharePoint site, and instead will have the API own most of the data.
In order for this to truly work, I need to secure the API to only allow authenticated SharePoint users to consume it. I believe I can use bearer token authentication, with the tenant being my office 365 client, but can anyone confirm that my SharePoint online users will always be a part of my Office 365 directory? Is it possible to add or invite users to my SharePoint portal without also having them added to my O365 AD?
Additionally, I have documentation regarding the contents of a bearer token, but can someone confirm/deny that the token will contain SharePoint user and group information as well? Will I be able to determine the SharePoint sites and permissions a user has access to from the token alone?