Examkin

Question

Difficulty: MediumPermissions, Scopes, and Consent

You are developing an ASP.NET Core Web API named InventoryAPI that exposes operations to manage warehouse inventory. You register InventoryAPI in Microsoft Entra ID. You need to configure permissions and scopes to support the following client applications:

1. InventorySPA: A Single Page Application where warehouse employees sign in and manage stock. The application must perform operations on behalf of the signed-in user.
2. InventoryDaemon: A background console application that syncs stock levels from an external system overnight. The daemon runs without user interaction.

Which two configurations should you perform to support these applications using the principle of least privilege?

  1. Expose a delegated scope named Inventory.ReadWrite in the API registration for InventoryAPI, and grant the InventorySPA application delegated permission to access this scope.Answer
  2. Define an App Role named Inventory.ReadWrite.All in the API registration for InventoryAPI, and grant the InventoryDaemon application application permission to access this role.Answer
  3. C
    Expose a delegated scope named Inventory.ReadWrite.All in the API registration for InventoryAPI, and grant the InventoryDaemon application delegated permission to access this scope.
  4. D
    Define an App Role named Inventory.ReadWrite in the API registration for InventoryAPI, and grant the InventorySPA application application permission to access this role.

Answer

Expose a delegated scope named Inventory.ReadWrite for the Single Page Application, and define an App Role named Inventory.ReadWrite.All for the daemon service.
The correct options are to expose a delegated scope for the browser-based Single Page Application (where employees sign in) and to define an App Role (application permission) for the background daemon service (which runs without user interaction).

Step-by-Step Solution

1
Analyze the identity context for the Single Page Application (InventorySPA).
Since warehouse employees sign in and perform actions, the application operates under a user session, requiring Delegated permissions.
Delegated permissions allow the application to act on behalf of the signed-in user.
2
Expose the API scope for the delegated access.
Expose a custom scope (e.g., Inventory.ReadWrite) in the API registration of InventoryAPI and configure the SPA to request delegated permissions for it.
This establishes the scope boundary for user-delegated actions.
3
Analyze the identity context for the background runner (InventoryDaemon).
Since the daemon runs on a schedule without user interaction, it cannot have a signed-in user, requiring Application permissions.
Application permissions allow applications to run non-interactively using their own identity.
4
Define and assign the App Role.
Define an App Role (e.g., Inventory.ReadWrite.All) within the API registration of InventoryAPI, and assign it to the daemon's service principal as an application permission.
This allows the daemon to authenticate using client credentials flow and obtain tokens containing the required application role.

Key Concept

Microsoft Entra ID distinguishes between Delegated permissions (used when a signed-in user is present) and Application permissions (used by background daemons or services without a signed-in user). API creators expose delegated permissions as scopes and application permissions as App Roles.
Rate this question

Topics

Permissions, Scopes, and Consent

More questions from this topic