An organization is developing an ASP.NET Core Web App named ExpenseTracker. The application allows signed-in employees to submit business expenses. To support this, ExpenseTracker must perform the following actions:
1. Retrieve the profile details of the signed-in user from Microsoft Graph.
2. Retrieve a list of departments from a custom protected Web API named DepartmentService (App ID URI: api://departmentservice) on behalf of the signed-in user.
You need to configure the permissions in Microsoft Entra ID for the ExpenseTracker application registration while adhering to the principle of least privilege. Which of the following configuration steps should you perform? (Select TWO)
- Add the User.Read delegated permission for the Microsoft Graph API.Cevap
- Add the api://departmentservice/Departments.Read delegated permission for the DepartmentService API.Cevap
- CAdd the User.Read.All application permission for the Microsoft Graph API.
- DAdd the Departments.Read delegated permission for the DepartmentService API.
Cevap
Add the User.Read delegated permission for the Microsoft Graph API, and add the api://departmentservice/Departments.Read delegated permission for the DepartmentService API.
To access Microsoft Entra ID protected resources on behalf of a signed-in user, client applications must be configured with Delegated permissions. The User.Read delegated permission for Microsoft Graph is the least-privileged permission required to read the signed-in user's profile. For custom APIs, scopes must be defined in the target API's registration (e.g., api://departmentservice) and then consented to by the client app using the fully qualified scope syntax: api://departmentservice/Departments.Read.
Adım Adım Çözüm
Anahtar Kavram
Microsoft Entra ID Delegated Permissions and Scope Configuration