Examkin

Question

Difficulty: MediumPermissions, Scopes, and Consent

You are developing a Single Page Application (SPA) named SalesPortal and a backend Web API named SalesAPI. You register both applications in Microsoft Entra ID. SalesPortal runs in the user's web browser and must call SalesAPI to retrieve the signed-in user's sales data. You need to configure the applications to ensure SalesPortal can access SalesAPI on behalf of the signed-in user while adhering to the principle of least privilege. Which action should you perform to configure the required permissions?

  1. A
    Create a Key Vault access policy that grants the SalesPortal application registration Get and List secret permissions for SalesAPI.
  2. B
    Configure a system-assigned managed identity for SalesPortal and assign the Sales.Read application permission to the identity.
  3. In the SalesAPI registration, expose an API scope named Sales.Read. In the SalesPortal registration, request a Delegated permission for the SalesAPI Sales.Read scope.Answer
  4. D
    Create a Shared Access Signature (SAS) token with read scope for the SalesAPI endpoint and configure SalesPortal to include this token in HTTP request headers.

Answer

In the SalesAPI registration, expose an API scope named Sales.Read. In the SalesPortal registration, request a Delegated permission for the SalesAPI Sales.Read scope.
To allow a Single Page Application (SPA) to access a custom Web API on behalf of a signed-in user, you must expose an API scope on the API's app registration (such as Sales.Read) and request it as a delegated permission on the client application registration. This ensures the app operates under the user's security context and permissions.

Step-by-Step Solution

1
Identify the application architecture and authentication flow requirements.
The application is a browser-based SPA calling a backend API, which requires the OAuth 2.0 authorization code flow with PKCE and delegated permissions (acting on behalf of the user).
Understanding the flow dictates that delegated permissions rather than application permissions or managed identities are required.
2
Expose a custom scope on the API application registration.
The SalesAPI registration exposes a scope such as Sales.Read, defining what permissions the client application can request.
Before a client application can request a delegated permission, the API must declare the available scopes in Entra ID.
3
Request the exposed scope as a delegated permission on the client application registration.
The SalesPortal registration requests the SalesAPI's Sales.Read delegated scope, allowing users to consent to this permission.
This links the client's request to the API's exposed capability, fulfilling the security configuration.

Key Concept

Delegated permissions and scopes in Microsoft Entra ID are used when an application needs to access resources on behalf of a signed-in user.
Rate this question

Topics

Permissions, Scopes, and Consent

More questions from this topic