Examkin

Question

Difficulty: HardPermissions, Scopes, and Consent

You are developing a background daemon service named ConfigSync that runs as a containerized application in Azure Container Instances. The service must periodically query Microsoft Graph to read tenant group memberships to synchronize configurations. No user is signed in when the service runs.

You register the application in Microsoft Entra ID. You need to configure the API permissions for the application registration while adhering to the principle of least privilege.

Which configuration should you implement?

  1. Add Microsoft Graph Application permissions for GroupMember.Read.All, and have a global administrator grant admin consent.Answer
  2. B
    Add Microsoft Graph Delegated permissions for GroupMember.Read.All, and request an access token using the client credentials flow.
  3. C
    Add Microsoft Graph Application permissions for Group.Read.All, and configure the application to prompt the container instance for interactive consent at runtime.
  4. D
    Add Microsoft Graph Delegated permissions for Group.Read.All, and request an access token using the resource owner password credentials (ROPC) flow with a service account.

Answer

Add Microsoft Graph Application permissions for GroupMember.Read.All, and have a global administrator grant admin consent.
The service runs as a background daemon without any user signed in, which dictates the use of the client credentials flow and Microsoft Graph Application permissions. To follow the principle of least privilege, GroupMember.Read.All should be chosen over Group.Read.All because it limits access strictly to reading memberships rather than full group properties. Application permissions always require a global administrator to grant admin consent.

Step-by-Step Solution

1
Determine the application type and interaction model.
Since the ConfigSync service runs as a background daemon with no user signed in, it must use the client credentials flow which requires Application permissions rather than Delegated permissions.
Delegated permissions require a signed-in user to act on behalf of, whereas Application permissions are used by applications that run without a signed-in user.
2
Select the permission scope adhering to the principle of least privilege.
Select GroupMember.Read.All instead of Group.Read.All.
GroupMember.Read.All is more restricted as it only allows reading group memberships and basic member profiles, whereas Group.Read.All allows reading all group properties and settings.
3
Determine the consent requirement.
A global administrator must grant admin consent for the tenant.
Application permissions always require administrator consent before they can be used by the application.

Key Concept

Microsoft Entra ID Application permissions and Client Credentials flow for background daemon services
Rate this question

Topics

Permissions, Scopes, and Consent

More questions from this topic