Soru

Zorluk: KolayPermissions, Scopes, and Consent

An administrator is configuring a Microsoft Entra ID app registration for a background daemon service that runs nightly without any user interaction. The daemon service must read all user profiles in the tenant using the Microsoft Graph API.

Which of the following configuration steps are required to implement this? (Select TWO)

  1. Configure the Application permission type for Microsoft Graph's User.Read.All.Cevap
  2. Grant tenant-wide admin consent for the configured User.Read.All permission.Cevap
  3. C
    Configure the Delegated permission type for Microsoft Graph's User.Read.All.
  4. D
    Generate a Shared Access Signature (SAS) token with User.Read.All scope.

Cevap

Configure the Application permission type for Microsoft Graph's User.Read.All, and grant tenant-wide admin consent for the permission.
For background services or daemons running without user interaction, Application permissions must be used because there is no signed-in user. Because the User.Read.All permission allows access to all user profiles in the tenant, Microsoft Entra ID requires tenant-wide admin consent to be granted before the token can be issued.

Adım Adım Çözüm

1
Identify the application interaction model.
Since the background daemon service runs nightly without any user interaction, it cannot run in the context of a signed-in user.
This establishes that Application permissions are required instead of Delegated permissions.
2
Determine the necessary permission scope and administrative requirements.
Microsoft Graph requires the User.Read.All application permission for reading all user profiles, which requires tenant-wide admin consent.
An administrator must grant consent before the daemon service can acquire a token to access tenant-wide profile data.

Anahtar Kavram

Differentiating between Delegated and Application permissions and understanding administrative consent requirements for Microsoft Entra ID app registrations.
Bu soruyu puanla