Examkin

Question

Difficulty: Very hardPermissions, Scopes, and Consent

An organization is developing a secure reporting system consisting of three components:

1. WebPortal: An Angular Single Page Application (SPA) that allows employees to view their personalized dashboard.
2. ReportAPI: A secured ASP.NET Core Web API (https://api.contoso.com) that retrieves data from a backend database.
3. DataSync: A background daemon service that runs on an on-premises server to upload bulk logs to ReportAPI nightly.

You have the following requirements:
- WebPortal must acquire an access token to call ReportAPI. When a user logs in, ReportAPI must read the user's manager's details from Microsoft Graph on behalf of the signed-in user using the on-behalf-of (OBO) flow.
- DataSync must authenticate using client credentials (client secrets) to POST logs directly to ReportAPI.
- The configuration must follow the principle of least privilege.
- Standard user logins must not be blocked by consent prompts during authentication.

Which configuration correctly implements the permissions, scopes, and token acquisition requests to meet these requirements?

  1. A
    Register ReportAPI, WebPortal, and DataSync in Microsoft Entra ID. In ReportAPI, expose Reports.Read and Logs.Write as delegated scopes. Configure DataSync to request a token using the client credentials flow with the scope set to api://<ReportAPI_Client_ID>/Logs.Write.
  2. B
    Register ReportAPI and WebPortal in Microsoft Entra ID. Generate a Shared Access Signature (SAS) token on the backend storage account with Read, Write, and List permissions. Configure both WebPortal and DataSync to authenticate to ReportAPI using this SAS token.
  3. Register ReportAPI, WebPortal, and DataSync in Microsoft Entra ID. In ReportAPI, expose the delegated scope Reports.Read and define an application role (application permission) named Logs.Write. Grant ReportAPI the Microsoft Graph delegated permission User.Read.All and perform tenant-wide admin consent. Configure WebPortal to request the scope api://<ReportAPI_Client_ID>/Reports.Read, and configure DataSync to request a token using the client credentials flow with the scope set to api://<ReportAPI_Client_ID>/.default.Answer
  4. D
    Register ReportAPI and WebPortal in Microsoft Entra ID. Create a Key Vault access policy that grants GET permissions to the DataSync service principal. Configure ReportAPI to read authorization scopes directly from Key Vault secrets using the secret name Reports.Read to determine if DataSync is allowed to write logs.

Answer

The correct configuration is to expose Reports.Read as a delegated scope and define Logs.Write as an application role in the ReportAPI registration. WebPortal requests the specific scope api://<ReportAPI_Client_ID>/Reports.Read for user-interactive sessions, while DataSync requests api://<ReportAPI_Client_ID>/.default in a client credentials flow to get its pre-consented application role. Tenant-wide admin consent must be granted to the ReportAPI for the Microsoft Graph User.Read.All delegated permission to enable OBO flows without standard user interruption.
The correct configuration uses a delegated scope (Reports.Read) for the user-interactive Single Page Application (SPA) and defines an application role/permission (Logs.Write) for the background daemon (DataSync) which runs without user interaction. The background daemon authenticates using the client credentials flow, which requires setting the scope parameter to the API's Application ID URI followed by '/.default' rather than requesting individual scopes. Additionally, because the Web API uses the on-behalf-of (OBO) flow to call Microsoft Graph for 'User.Read.All' (which requires admin consent), performing tenant-wide admin consent prevents standard users from being blocked during login.

Step-by-Step Solution

1
Differentiate between delegated and application permissions based on the client application context.
WebPortal (SPA) requires delegated permissions (user context), while DataSync (daemon service) requires application permissions (app roles/service context).
Delegated permissions are used when an app acts on behalf of a signed-in user, whereas application permissions are used when an app runs in the background without a user.
2
Determine the correct scope syntax and acquisition flow for both clients.
WebPortal requests api://<ReportAPI_ClientID>/Reports.Read using authorization code flow. DataSync requests api://<ReportAPI_ClientID>/.default using client credentials flow.
Microsoft Entra ID client credentials flow does not allow requesting individual scopes; it requires the target API's ID URI with the /.default suffix to retrieve all assigned application permissions.
3
Identify the Microsoft Graph consent requirements for the backend on-behalf-of (OBO) call.
Grant ReportAPI the delegated User.Read.All permission and perform tenant-wide admin consent.
Reading a user's manager profile via User.Read.All is a high-privilege Graph permission requiring admin consent. Granting tenant-wide admin consent prevents standard users from encountering consent blocks during login.

Key Concept

Microsoft Entra ID Delegated vs. Application Permissions and Client Credentials Scope Configuration
Rate this question

Topics

Permissions, Scopes, and Consent

More questions from this topic