Examkin

Question

Difficulty: MediumPermissions, Scopes, and Consent

You are developing a web application named DocPortal. The application must perform the following security actions:
1. Allow users to sign in and view files stored in their personal OneDrive folders.
2. Allow a scheduled background service within the application to read group memberships across the tenant without a signed-in user.

You need to configure the Microsoft Graph permissions for the application registration. The solution must adhere to the principle of least privilege.

Which two permissions should you configure? (Select two.)

  1. Files.Read configured as a Delegated permission.Answer
  2. GroupMember.Read.All configured as an Application permission.Answer
  3. C
    Files.Read configured as an Application permission.
  4. D
    A Shared Access Signature (SAS) token with service-level read scopes registered as an API permission in the application registration.

Answer

Configure Files.Read as a Delegated permission and GroupMember.Read.All as an Application permission.
Delegated permissions are required when the application needs to act on behalf of a signed-in user (such as reading the user's personal OneDrive files via Files.Read). Application permissions are required when the application runs as a background service without a user present (such as a scheduled job reading group memberships via GroupMember.Read.All). This configuration ensures proper identity context separation and complies with the principle of least privilege.

Step-by-Step Solution

1
Determine the identity context for the first requirement.
The requirement calls for a signed-in user to access their own files, which requires a Delegated permission.
Delegated permissions run in the context of the signed-in user.
2
Identify the minimum required delegated scope for the first requirement.
The scope is Files.Read.
Files.Read provides read access to the signed-in user's files, fulfilling the least privilege concept.
3
Determine the identity context for the second requirement.
The requirement calls for a scheduled background service to read group memberships without a signed-in user, which requires an Application permission.
Application permissions run in the context of the application service principal rather than a user.
4
Identify the minimum required application scope for the second requirement.
The scope is GroupMember.Read.All.
GroupMember.Read.All is the least privileged application permission that allows reading group memberships.

Key Concept

Selecting and configuring the correct permission type (Delegated vs. Application) and scope for Microsoft Graph API integrations.
Rate this question

Topics

Permissions, Scopes, and Consent

More questions from this topic