Examkin

Question

Difficulty: HardPermissions, Scopes, and Consent

You are configuring permissions and consent in Microsoft Entra ID for an enterprise scheduling solution consisting of two applications:

1. SyncDaemon: A background service (daemon) that runs continuously without user interaction to synchronize user profile information from Microsoft Graph.
2. PlannerSPA: A client-side Single Page Application (SPA) that allows authenticated users to access a custom backend Web API named `TaskAPI` to manage their tasks. The backend API is registered with the App ID URI `api://taskapi.contoso.com`.

Which two of the following configuration actions must you perform to implement the correct permissions and consent flows? (Select two.)

  1. For SyncDaemon, assign the Microsoft Graph Application permission User.Read.All and perform an admin consent flow.Answer
  2. B
    For SyncDaemon, assign the Microsoft Graph Delegated permission User.Read.All and acquire the access token using the client credentials flow.
  3. For PlannerSPA, configure the application to request the scope api://taskapi.contoso.com/Tasks.Manage to obtain an access token for the backend API.Answer
  4. D
    For PlannerSPA, configure the application to request the scope Tasks.Manage without a URI prefix, and rely on Entra ID to resolve the scope to TaskAPI within the tenant.

Answer

To configure the solution correctly, assign the Microsoft Graph Application permission User.Read.All with admin consent for SyncDaemon, and configure PlannerSPA to request the fully qualified scope api://taskapi.contoso.com/Tasks.Manage.
The correct actions are assigning the Application permission User.Read.All with admin consent for the background SyncDaemon service, and requesting the fully qualified custom scope api://taskapi.contoso.com/Tasks.Manage for the PlannerSPA. Background daemons run without user interaction and require Application permissions with tenant admin consent. Single-page applications calling a custom API require delegated access using the fully qualified App ID URI scope format.

Step-by-Step Solution

1
Determine the identity flow and permission type for SyncDaemon.
Since SyncDaemon is a background service running without user interaction, it must use the client credentials flow, which requires Application permissions (User.Read.All) rather than Delegated permissions.
Delegated permissions require an active user session, whereas Application permissions represent the application's identity.
2
Determine the consent requirement for SyncDaemon's permissions.
Microsoft Graph Application permissions require tenant-wide admin consent.
Admin consent prevents non-admin users from granting permissions that could access directory-wide data.
3
Determine the correct scope syntax for PlannerSPA calling TaskAPI.
The scope must be fully qualified as api://taskapi.contoso.com/Tasks.Manage.
Microsoft Entra ID requires custom API scopes to be requested using their full URI prefix so it can resolve the target resource registration.

Key Concept

Distinction between Delegated and Application permissions, and proper custom API scope syntax in Microsoft Entra ID.
Rate this question

Topics

Permissions, Scopes, and Consent

More questions from this topic