Examkin

Question

Difficulty: Very hardApp Registrations and Service Principals

You are designing the security architecture for a suite of internally developed Azure microservices. One of the backend services, OrderProcessor, is registered as a Web API in Microsoft Entra ID. You must enforce a policy where other client microservices (which authenticate daemon-to-daemon using the client credentials flow) cannot acquire an access token for OrderProcessor unless they have been explicitly assigned permission by an administrator. If an unassigned client service attempts to request a token for OrderProcessor, Microsoft Entra ID must deny the token request at the token endpoint. Which configuration step must you perform to enforce this behavior?

  1. Set the appRoleAssignmentRequired property to true on the OrderProcessor service principal.Answer
  2. B
    Set the appRoleAssignmentRequired property to true on the application registrations of each client microservice.
  3. C
    Configure a Key Vault access policy on the Azure Key Vault instance containing the client microservice credentials.
  4. D
    Configure the oauth2PermissionScopes in the application manifest of OrderProcessor to require administrator consent.

Answer

Set the appRoleAssignmentRequired property to true on the OrderProcessor service principal.
The correct action is to set the appRoleAssignmentRequired property to true on the OrderProcessor service principal. In Microsoft Entra ID, the service principal represents the local instance of an application within a tenant. Setting this property to true restricts token issuance for that API/resource to only those users and service principals that have been explicitly assigned to one of the application's defined roles.

Step-by-Step Solution

1
Identify the authentication flow and requirements.
The scenario describes daemon-to-daemon authentication (client credentials flow) without a signed-in user context.
This establishes that the solution requires application permissions and service principal-level access controls rather than user-delegated scopes.
2
Select the correct location for enforcing token block policies.
The policy must be applied to the resource's representation in the tenant (its service principal object).
Microsoft Entra ID evaluates token requests against the target resource's service principal properties in the executing tenant, not the client's application registration.
3
Configure the assignment requirement property.
Set the appRoleAssignmentRequired property (visible as 'Assignment required?' in the Azure Portal) to true on the service principal.
This explicitly instructs Microsoft Entra ID to validate that the requesting service principal has an active app role assignment before issuing an access token.

Key Concept

Enforcing application assignment requirements on service principals for daemon-to-daemon token acquisition.
Rate this question

Topics

App Registrations and Service Principals

More questions from this topic