Examkin

Question

Difficulty: MediumPermissions, Scopes, and Consent

You are developing a native mobile application named FleetApp that allows delivery drivers to view their own calendar events from Microsoft Graph and upload telemetry data to a custom backend web API named RouteAPI. You register RouteAPI in Microsoft Entra ID and expose a custom scope named Telemetry.Write.

You register FleetApp in Microsoft Entra ID. The application must perform all actions on behalf of the signed-in driver, allow drivers to consent to permissions themselves, and adhere to the principle of least privilege.

Which permissions should you configure for the FleetApp registration?

  1. A
    Application permission Calendars.Read for Microsoft Graph, and Application permission Telemetry.Write for RouteAPI
  2. Delegated permission Calendars.Read for Microsoft Graph, and Delegated permission Telemetry.Write for RouteAPIAnswer
  3. C
    Delegated permission Calendars.Read.All for Microsoft Graph, and Delegated permission Telemetry.Write for RouteAPI
  4. D
    Delegated permission Calendars.Read for Microsoft Graph, and Application permission Telemetry.Write for RouteAPI

Answer

Delegated permission Calendars.Read for Microsoft Graph, and Delegated permission Telemetry.Write for RouteAPI
The correct configuration uses Delegated permissions for both APIs because the mobile application acts on behalf of a signed-in user (the driver). By selecting Calendars.Read instead of Calendars.Read.All, the application adheres to the principle of least privilege and allows the drivers to consent to the permissions themselves, as directory-level read permissions are not required.

Step-by-Step Solution

1
Analyze the client application context and user presence requirement.
The application runs on a mobile device and must perform actions using the identity of a signed-in user (the driver) and allow self-consent.
This determines that Delegated permissions (which run in the context of a signed-in user) must be used instead of Application permissions (which run as a daemon or background service without a user).
2
Evaluate the required scope level for Microsoft Graph access under the principle of least privilege.
The driver only needs to view their own calendar events, so the Calendars.Read permission is sufficient.
Using Calendars.Read.All would allow access to all users' calendars, which requires admin consent and violates the principle of least privilege.
3
Select the correct permission type and scope for the custom backend API.
FleetApp needs delegated permission for the custom scope Telemetry.Write exposed by RouteAPI.
Since the write operation is initiated by the signed-in driver, the driver must delegate their authority to the client application using a delegated permission.

Key Concept

Delegated vs. Application permissions and least-privilege scoping in Microsoft Entra ID app registrations.
Estimated Time:1m 30s
Rate this question

Topics

Permissions, Scopes, and Consent

More questions from this topic