Examkin

Question

Difficulty: MediumPermissions, Scopes, and Consent

You are developing a web application named ComplianceHub and a backend Web API named AuditAPI. Both applications are registered in Microsoft Entra ID. The applications must meet the following security requirements:

1. ComplianceHub must allow signed-in users to read their own audit reports from AuditAPI.
2. A background archiving service must run nightly to read all audit logs from AuditAPI without user interaction.

You need to configure the permissions and scopes for the application registrations. Which two configurations should you perform? (Select two.)

  1. Configure AuditAPI to expose a delegated scope named Audits.Read, and grant the ComplianceHub app registration the delegated permission for api://<AuditAPI_App_ID>/Audits.Read.Answer
  2. Configure AuditAPI to expose an application permission (App Role) named Audits.Archive with the allowed member type set to Applications, grant ComplianceHub this permission, and obtain administrator consent.Answer
  3. C
    Configure ComplianceHub to request the delegated permission api://<AuditAPI_App_ID>/Audits.Read for the background service, and acquire tokens using the OAuth 2.0 client credentials flow.
  4. D
    Generate a Shared Access Signature (SAS) token containing read and write permissions, and configure ComplianceHub to pass this token in the Authorization header to AuditAPI.
  5. E
    Configure AuditAPI to expose the scope Audits.Read as an application permission, and configure ComplianceHub to request it without administrator consent.

Answer

Configure the backend API to expose a delegated scope and grant the client application the delegated permission (api://<AuditAPI_App_ID>/Audits.Read) for user-interactive operations, and configure the backend API to expose an application permission (App Role) and obtain administrator consent for background operations.
The correct configurations involve defining a delegated scope on the API and granting it to the client for user-centric access, and defining an application permission (App Role) with admin consent for the service-to-service background access. For user-interactive access, the API exposes a scope (Audits.Read) and the client requests delegated access using the App ID URI prefix. For background access, the API exposes an App Role, which is assigned to the client application and requires admin consent.

Step-by-Step Solution

1
Analyze the user-interactive requirement.
The client application must act on behalf of the signed-in user to access the API. This requires a delegated permission (scope) such as api://<AuditAPI_App_ID>/Audits.Read.
Delegated permissions allow applications to run in the context of a signed-in user, honoring their permissions and identity.
2
Analyze the background service requirement.
The service runs automatically without user interaction. This requires application permissions (App Roles) instead of delegated scopes.
Application permissions are used by daemon services or background tasks that run without a signed-in user.
3
Determine consent requirements.
Application permissions always require administrator consent, whereas delegated permissions for custom APIs may be consented to by users or administrators depending on the organization's policies.
Since application permissions grant access to data across the directory or service without user intervention, they carry higher risk and require admin approval.

Key Concept

Microsoft Entra ID delegated permissions (scopes) vs. application permissions (App Roles) and consent requirements.
Rate this question

Topics

Permissions, Scopes, and Consent

More questions from this topic