An administrator is configuring a Microsoft Entra ID app registration for a background daemon service that runs nightly without any user interaction. The daemon service must read all user profiles in the tenant using the Microsoft Graph API.
Which of the following configuration steps are required to implement this? (Select TWO)
- Configure the Application permission type for Microsoft Graph's User.Read.All.Cevap
- Grant tenant-wide admin consent for the configured User.Read.All permission.Cevap
- CConfigure the Delegated permission type for Microsoft Graph's User.Read.All.
- DGenerate a Shared Access Signature (SAS) token with User.Read.All scope.
Cevap
Configure the Application permission type for Microsoft Graph's User.Read.All, and grant tenant-wide admin consent for the permission.
For background services or daemons running without user interaction, Application permissions must be used because there is no signed-in user. Because the User.Read.All permission allows access to all user profiles in the tenant, Microsoft Entra ID requires tenant-wide admin consent to be granted before the token can be issued.
Adım Adım Çözüm
Anahtar Kavram
Differentiating between Delegated and Application permissions and understanding administrative consent requirements for Microsoft Entra ID app registrations.