Examkin

Question

Difficulty: EasyPermissions, Scopes, and Consent

A developer is configuring a Microsoft Entra ID app registration for a web application named SalesReporter. The web application allows users to sign in and needs to access Microsoft Graph to read the signed-in user's profile and send emails on their behalf. Which two Microsoft Graph delegated permissions must be configured? Select two options.

  1. User.ReadAnswer
  2. Mail.SendAnswer
  3. C
    User.Read (Application permission)
  4. D
    A Shared Access Signature (SAS) token configured with Mail.Send scopes

Answer

The application requires User.Read and Mail.Send delegated permissions.
The correct options are User.Read and Mail.Send delegated permissions because the web application acts on behalf of the signed-in user (requiring delegated permissions) to read their profile and send emails.

Step-by-Step Solution

1
Identify that the application acts on behalf of a signed-in user, which requires Delegated permissions rather than Application permissions or Shared Access Signatures.
Confirm that Delegated permissions must be selected.
Delegated permissions allow the application to act on behalf of the signed-in user.
2
Determine that to read the user's basic profile, the User.Read delegated permission is required.
Select User.Read delegated permission.
This permission allows basic profile reading upon login.
3
Determine that to send emails as the signed-in user, the Mail.Send delegated permission is required.
Select Mail.Send delegated permission.
This permission allows sending email on behalf of the signed-in user.

Key Concept

Microsoft Entra ID delegated permissions allow an application to access APIs on behalf of a signed-in user.
Rate this question

Topics

Permissions, Scopes, and Consent

More questions from this topic