Examkin

Question

Difficulty: MediumMicrosoft Identity Platform Authentication

A C# daemon application runs as a Windows Service on an on-premises server. The application must authenticate to the Microsoft Identity Platform without user interaction and query directory metadata from Microsoft Graph. You configure the application registration in Microsoft Entra ID with the Directory.Read.All Application permission, and an administrator grants tenant-wide consent. In your code, you instantiate an IConfidentialClientApplication instance. Which string array should you pass as the scopes argument to the AcquireTokenForClient method to successfully retrieve the access token?

  1. A
    new string[] { "Directory.Read.All" }
  2. new string[] { "https://graph.microsoft.com/.default" }Answer
  3. C
    new string[] { "https://graph.microsoft.com/Directory.Read.All" }
  4. D
    new string[] { "https://graph.microsoft.com/user_impersonation" }

Answer

The string array containing 'https://graph.microsoft.com/.default'
For the Client Credentials flow (AcquireTokenForClient), the Microsoft Identity Platform requires the scopes parameter to be the resource root URL followed by '/.default' (e.g., 'https://graph.microsoft.com/.default'). This triggers the token service to inspect the application registration and issue a token containing all application permissions consented to by the administrator. Statically defining and consenting to scopes is mandatory for daemon applications.

Step-by-Step Solution

1
Analyze the authentication flow specified in the scenario.
The application is a daemon application running as a Windows Service without user interaction, which dictates the use of the Client Credentials flow (Confidential Client Application flow).
Choosing the correct OAuth 2.0 flow is necessary to determine the token acquisition method and scope requirements.
2
Determine the scope requirement for the Client Credentials flow in the Microsoft Identity Platform.
In the Client Credentials flow, permissions are statically assigned during app registration and must be consented by an administrator. Consequently, MSAL.NET requires requesting the resource root followed by '/.default' to obtain all pre-consented permissions.
Requesting individual scopes like Directory.Read.All at runtime is not supported in the Client Credentials flow and results in a runtime error.
3
Construct the correct scope array argument for MSAL.NET.
The correct argument is a string array containing 'https://graph.microsoft.com/.default'.
This matches the required format for requesting token scopes on behalf of the application itself.

Key Concept

Microsoft Identity Platform Client Credentials flow requires the '/.default' scope pattern to request statically consented application permissions.
Estimated Time:1m 30s
Rate this question

Topics

Microsoft Identity Platform Authentication

More questions from this topic