Examkin

Question

Difficulty: MediumApp Registrations and Service Principals

You are configuring a daemon application (App1) to call a custom Web API (API1) programmatically. Both applications are registered in Microsoft Entra ID. You need to configure API1 to expose an application permission, assign that permission to App1, and ensure App1 can successfully request an access token. Which four actions should you perform in sequence?

  1. 1In the API1 registration, create an App Role with the allowed member types set to Applications.
  2. 2In the App1 registration, add the defined App Role of API1 under API permissions.
  3. 3In the App1 registration, select Grant admin consent to authorize the added permission.
  4. 4In the App1 application code, request an access token using the Client Credentials flow.

Answer

To configure the daemon application (App1) to call the Web API (API1) programmatically, you must first create the App Role (Application type) in the API1 registration. Next, add this App Role under the API permissions of the App1 registration. After that, grant tenant-wide admin consent for the permission in App1. Finally, request an access token in the App1 application code using the Client Credentials flow.
The correct sequence starts with defining the App Role on the target API (API1) because a permission must exist before it can be assigned. Next, the client application (App1) must request this permission by adding it to its registration. After the permission is registered, a tenant administrator must grant consent. Finally, with the permission consented, the client application can execute its code to request the access token using the client credentials flow.

Step-by-Step Solution

1
In the API1 registration, create an App Role with the allowed member types set to Applications.
The custom Web API exposes an application permission that other service principals can request.
A permission role must be declared on the target API resource before any client applications can reference or request it.
2
In the App1 registration, add the defined App Role of API1 under API permissions.
App1 declares a dependency on the API1 application permission.
The client application registration must explicitly declare which permissions it requires to access target resources.
3
In the App1 registration, select Grant admin consent to authorize the added permission.
The application permission is approved for use within the directory tenant.
Application permissions (App Roles) cannot be consented to by regular users and must be granted tenant-wide by an administrator before tokens can be issued.
4
In the App1 application code, request an access token using the Client Credentials flow.
The application receives an access token containing the role claims necessary to call the Web API.
With consent granted, the daemon application can now authenticate and request a token representing its own identity.

Key Concept

Configuring application permissions and client credentials authentication flow in Microsoft Entra ID.
Estimated Time:2m 0s
Rate this question

Topics

App Registrations and Service Principals

More questions from this topic