Examkin

Question

Difficulty: MediumPermissions, Scopes, and Consent

A company is deploying an automated synchronization service named DeptSync that runs as a daily background task on an Azure virtual machine. The service must connect to Microsoft Graph to update the department and job title properties of all user accounts in Microsoft Entra ID. The service runs without any user interaction.

You need to configure the Microsoft Entra ID application registration for DeptSync to allow the service to authenticate and perform these updates securely using the principle of least privilege.

Which two actions should you perform? (Choose two.)

  1. Configure the application registration with the User.ReadWrite.All Application permission for the Microsoft Graph API.Answer
  2. Grant tenant-wide admin consent for the configured Microsoft Graph API permissions.Answer
  3. C
    Configure the application registration with the User.ReadWrite.All Delegated permission for the Microsoft Graph API.
  4. D
    Configure the application registration with the User.ReadWrite Delegated permission for the Microsoft Graph API.

Answer

To configure the daemon service, you must add the User.ReadWrite.All Application permission to the Microsoft Graph API and grant tenant-wide administrator consent.
The background synchronization service runs as a scheduled task without a signed-in user, meaning it must authenticate as its own identity using the client credentials flow. Therefore, it requires Application permissions rather than Delegated permissions. Updating user profile details (such as department and job title) across all accounts in the tenant requires the User.ReadWrite.All permission. Because Application permissions grant broad access to directory data, Microsoft Entra ID requires tenant-wide administrator consent to be granted before the application can successfully call the Microsoft Graph API.

Step-by-Step Solution

1
Determine the application type and authentication context.
The service runs in the background without user interaction, requiring the client credentials flow and Application permissions.
Delegated permissions require a signed-in user, whereas daemon services run under their own identity.
2
Select the appropriate Microsoft Graph permission scope.
Choose the User.ReadWrite.All permission.
The service needs to read and write department and job title properties for all user accounts in the directory, and User.ReadWrite.All covers these operations.
3
Grant the necessary consent for the permissions.
Grant tenant-wide administrator consent.
All Microsoft Graph Application permissions require administrator approval before they can be used.

Key Concept

Microsoft Entra ID Application permissions and administrator consent requirements for daemon applications.
Rate this question

Topics

Permissions, Scopes, and Consent

More questions from this topic