Examkin

Question

Difficulty: MediumApp Registrations and Service Principals

You are developing a Single Page Application (SPA) in React. The application runs in the user's web browser, authenticates users via Microsoft Entra ID, and reads their calendar events from Microsoft Graph on their behalf. You are creating the app registration in Microsoft Entra ID. Which two configurations should you implement to support this scenario?

  1. Configure the Redirect URI with the platform type set to Single-page application (SPA).Answer
  2. Add the delegated Calendars.Read permission for Microsoft Graph to the application registration.Answer
  3. C
    Configure a system-assigned managed identity for the application to authenticate from the browser.
  4. D
    Generate a Shared Access Signature (SAS) token with calendar access scope to authenticate the client.

Answer

Configure the Redirect URI with the platform type set to Single-page application (SPA) and add the delegated Calendars.Read permission for Microsoft Graph to the application registration.
To configure authentication and authorization for a Single Page Application (SPA) accessing Microsoft Graph on behalf of a user, the application registration must use the 'Single-page application (SPA)' platform type for the Redirect URI. This platform type enables the Authorization Code Flow with PKCE, which is the secure authentication flow recommended for browser-based clients. Additionally, because the application needs to access the user's calendar data on their behalf, the 'Calendars.Read' delegated permission must be added to the application registration so that the user (or administrator) can consent to the access.

Step-by-Step Solution

1
Determine the application type and authentication flow.
The application is a browser-based Single Page Application (SPA). Secure authentication requires using the Authorization Code Flow with PKCE rather than the implicit flow or client credentials flow.
Choosing the correct flow prevents token exposure and ensures compatibility with modern security standards.
2
Configure the Redirect URI platform type in the Entra ID application registration.
Setting the platform type specifically to 'Single-page application (SPA)' triggers the Authorization Code Flow with PKCE.
This is required to allow the client library (MSAL.js) to securely trade authorization codes for tokens without a client secret.
3
Identify and assign the correct API permission type.
Because the application accesses the resource (calendar events) on behalf of a signed-in user, the delegated permission 'Calendars.Read' must be added.
Application permissions are meant for service-to-service communication without user presence, whereas delegated permissions are correct for user-interactive sessions.

Key Concept

Configuring App Registrations in Microsoft Entra ID for Single-Page Applications (SPAs) accessing protected APIs.
Rate this question

Topics

App Registrations and Service Principals

More questions from this topic