Examkin

Question

Difficulty: HardPermissions, Scopes, and Consent

You are developing a secure client-side Single Page Application (SPA) named OrderClient and a backend Web API named OrderProcessor. The OrderClient application must make HTTP requests to OrderProcessor to retrieve order history on behalf of the currently signed-in user. You need to configure the Microsoft Entra ID app registrations for both applications to secure the API calls using OAuth 2.0. Which of the following configurations should you implement?

  1. In the OrderProcessor app registration, configure the Application ID URI to api://<OrderProcessor-ClientId>, expose a delegated scope named Orders.Read, and in the OrderClient app registration, add the delegated permission api://<OrderProcessor-ClientId>/Orders.Read.Answer
  2. B
    In the OrderProcessor app registration, generate a Shared Access Signature (SAS) token scoped to Orders.Read, and store this token in the OrderClient application configuration to authorize all user-delegated API requests.
  3. C
    Enable a system-assigned managed identity for the App Service hosting OrderClient, and configure OrderProcessor to grant access to the managed identity's service principal using an Application permission.
  4. D
    In the OrderProcessor app registration, configure the Application ID URI, expose an Application permission (App Role) named Orders.Read, and configure the OrderClient app registration to use the delegated permission api://<OrderProcessor-ClientId>/.default.

Answer

Configuring a delegated scope on the backend Web API registration and granting it as a delegated permission to the SPA registration.
Configuring a delegated scope on the backend Web API and granting it to the SPA registration correctly enforces OAuth 2.0 delegated authorization. Using the Application ID URI prefix ensures the scope is globally unique in Microsoft Entra ID, allowing the client application to obtain tokens specifically for that resource.

Step-by-Step Solution

1
Identify the application architecture and user context.
The client is a Single Page Application (SPA) calling a backend Web API on behalf of a signed-in user.
This establishes that delegated permissions (scopes) are required rather than application permissions (App Roles) or managed identities.
2
Expose the custom scope on the backend Web API registration.
Configure an Application ID URI (e.g., api://<OrderProcessor-ClientId>) and define a delegated scope (e.g., Orders.Read).
Microsoft Entra ID requires custom API scopes to be prefixed with the Application ID URI to ensure global uniqueness.
3
Grant the delegated permission to the client application registration.
Add the fully qualified scope URI (api://<OrderProcessor-ClientId>/Orders.Read) to the client application's requested API permissions.
This allows the SPA to request access tokens containing the custom scope during the OAuth 2.0 authorization code flow.

Key Concept

Microsoft Entra ID Delegated Permissions and Custom API Scopes
Rate this question

Topics

Permissions, Scopes, and Consent

More questions from this topic