Restrict access to specifc users

By default everything seems to be public facing, but I'd like to expose my static web app to select people within my organization. I've had a look at the [docs](https://docs.microsoft.com/en-us/azure/static-web-apps/authentication-authorization) and I'm not quite sure how I would block access to *all* users except the ones I explicitly invite via the Role management blade in the Azure portal.

I've added the following `routes.json` file to the `app_location` folder (= root folder of my Hugo app):

```json
{
"routes": [
{
"route": "/login",
"serve": "/.auth/login/aad"
},
{
"route": "/*",
"allowedRoles": [
"authenticated"
]
}
],
"platformErrorOverrides": [
{
"errorType": "Unauthenticated",
"statusCode": "302",
"serve": "/login"
}
]
}
```

... but it seems to completely ignore it 🤷.
This will also allow anyone who is able to authenticate against our AAD tenant, not just the people I invited.

I'm using the Azure DevOps task to build and deploy my Hugo app, should that matter.