Examkin

Question

Difficulty: EasyPermissions, Scopes, and Consent

You are developing a Single Page Application (SPA) using React that allows employees to view their own profile information from Microsoft Graph after signing in. Which permission type must you configure in the Microsoft Entra ID application registration to ensure that the application accesses the API on behalf of the signed-in user?

  1. A
    Key Vault access policy permissions
  2. B
    Application permissions
  3. Delegated permissionsAnswer
  4. D
    Shared Access Signature (SAS) permissions

Answer

Delegated permissions
Delegated permissions allow the application to act on behalf of the signed-in user. The application can only access resources that the user itself has access to, which is appropriate for a React SPA where users log in to see their own profile information.

Step-by-Step Solution

1
Identify the client application type and runtime context.
The application is a React Single Page Application (SPA) where users sign in directly.
Understanding whether a user is present during execution is critical for choosing the right permission model.
2
Determine the required access scope for the Microsoft Graph API request.
The application needs to access the signed-in user's own profile information (on-behalf-of access).
Accessing resources on behalf of the active user requires user consent and delegation.
3
Select the correct Entra ID permission category based on the user context.
Delegated permissions are selected because they allow the application to run in the context of the signed-in user.
Application permissions are reserved for background services without user interaction, while SAS and Key Vault policies do not apply to Microsoft Graph permissions.

Key Concept

Delegated permissions allow applications to act on behalf of a signed-in user, whereas application permissions allow apps to run independently as background services.
Rate this question

Topics

Permissions, Scopes, and Consent

More questions from this topic