Examkin

Question

Difficulty: MediumPermissions, Scopes, and Consent

You are configuring permissions in Microsoft Entra ID for a Single Page Application (SPA) named TimeTrackerSPA. The application runs in the user's browser and must perform the following actions:

1. Retrieve the signed-in user's profile details from Microsoft Graph.
2. Read and write time entries using a custom backend Web API named TimeSheetAPI on behalf of the signed-in user.

The TimeSheetAPI application registration exposes a delegated scope named TimeSheet.Write.

Which permissions should you configure for the TimeTrackerSPA application registration?

  1. A
    Microsoft Graph: Application permission User.Read.All; TimeSheetAPI: Application permission TimeSheet.Write
  2. B
    Microsoft Graph: Delegated permission User.Read; TimeSheetAPI: Application permission TimeSheet.Write
  3. Microsoft Graph: Delegated permission User.Read; TimeSheetAPI: Delegated permission TimeSheet.WriteAnswer
  4. D
    Microsoft Graph: Delegated permission Directory.Read.All; TimeSheetAPI: Delegated permission TimeSheet.Write

Answer

The correct permission configuration is Delegated permission: User.Read (from Microsoft Graph) and Delegated permission: TimeSheet.Write (from TimeSheetAPI).
The application is a Single Page Application (SPA) that runs in the browser under the context of the signed-in user. Therefore, it must use Delegated permissions to access resources on behalf of the user. To read the signed-in user's profile, the delegated permission 'User.Read' is sufficient and does not require administrator consent, fulfilling the principle of least privilege. To call the backend Web API on behalf of the user, the application must use the delegated scope 'TimeSheet.Write' exposed by the API.

Step-by-Step Solution

1
Identify the application type and its execution context.
The application is a Single Page Application (SPA) running in a web browser.
Determines whether to use Delegated permissions (user context) or Application permissions (daemon/background service context).
2
Determine the permission type based on the application context.
Since the SPA operates on behalf of a signed-in user and cannot securely store client secrets, Delegated permissions must be used for both Microsoft Graph and TimeSheetAPI.
Ensures secure token acquisition and proper user-context propagation.
3
Select the least-privileged scopes that satisfy the functional requirements.
Microsoft Graph 'User.Read' is selected instead of 'Directory.Read.All' because reading the signed-in user's own profile does not require administrative consent or directory-wide access. The custom API scope 'TimeSheet.Write' is added as a delegated permission.
Applies security best practices by minimizing access and avoiding unnecessary admin consent requirements.

Key Concept

Configuring Delegated permissions versus Application permissions and applying the principle of least privilege for Microsoft Entra ID app registrations.
Rate this question

Topics

Permissions, Scopes, and Consent

More questions from this topic