Examkin

Question

Difficulty: MediumPermissions, Scopes, and Consent

An organization is developing an ASP.NET Core Web App named ExpenseTracker. The application allows signed-in employees to submit business expenses. To support this, ExpenseTracker must perform the following actions:
1. Retrieve the profile details of the signed-in user from Microsoft Graph.
2. Retrieve a list of departments from a custom protected Web API named DepartmentService (App ID URI: api://departmentservice) on behalf of the signed-in user.

You need to configure the permissions in Microsoft Entra ID for the ExpenseTracker application registration while adhering to the principle of least privilege. Which of the following configuration steps should you perform? (Select TWO)

  1. Add the User.Read delegated permission for the Microsoft Graph API.Answer
  2. Add the api://departmentservice/Departments.Read delegated permission for the DepartmentService API.Answer
  3. C
    Add the User.Read.All application permission for the Microsoft Graph API.
  4. D
    Add the Departments.Read delegated permission for the DepartmentService API.

Answer

Add the User.Read delegated permission for the Microsoft Graph API, and add the api://departmentservice/Departments.Read delegated permission for the DepartmentService API.
To access Microsoft Entra ID protected resources on behalf of a signed-in user, client applications must be configured with Delegated permissions. The User.Read delegated permission for Microsoft Graph is the least-privileged permission required to read the signed-in user's profile. For custom APIs, scopes must be defined in the target API's registration (e.g., api://departmentservice) and then consented to by the client app using the fully qualified scope syntax: api://departmentservice/Departments.Read.

Step-by-Step Solution

1
Analyze the client application type and runtime context.
The client application is an ASP.NET Core Web App where users sign in, and API calls must be made on behalf of the signed-in user. This dictates the use of delegated permissions rather than application permissions.
Delegated permissions allow the application to act on behalf of the signed-in user, enforcing the user's specific access boundaries.
2
Identify the least-privileged Microsoft Graph permission needed to retrieve the user's profile.
The User.Read delegated permission is selected.
User.Read allows the application to read the profile of the signed-in user, which satisfies the first requirement under the principle of least privilege without exposing other users' profiles.
3
Determine the correct custom API scope and format for calling the DepartmentService API.
The api://departmentservice/Departments.Read delegated scope is selected.
Custom API scopes requested by external clients must use the fully qualified URI format (prefixed by the resource's App ID URI) to successfully resolve the resource during token acquisition.

Key Concept

Microsoft Entra ID Delegated Permissions and Scope Configuration
Rate this question

Topics

Permissions, Scopes, and Consent

More questions from this topic