To be more precise: MS loves to make you think you need those, see also WebSocket support. But in reality you don’t need that, if you know what you are doing. Also don’t implement your authorization server folks, at least when possible.