Examkin

Soru

Zorluk: Çok zorPermissions, Scopes, and Consent

An enterprise architecture requires implementing two new applications integrated with Microsoft Entra ID:

1. SyncDaemon: A background service that runs without user interaction to synchronize user profile information across all users in the tenant.
2. UserPortal: A single-page application (SPA) using the OAuth 2.0 authorization code flow with PKCE, allowing signed-in users to view their own profile and access a custom secure web API.

You need to configure the permissions, scopes, and consent for both applications following the principle of least privilege.

Which two configurations should you implement?

  1. Configure SyncDaemon with the Microsoft Graph Application permission User.Read.All and have a tenant administrator grant tenant-wide consent.Cevap
  2. Configure UserPortal with the Microsoft Graph Delegated permission User.Read and define a custom scope in the format api://<API_ClientId>/Access on the custom web API registration.Cevap
  3. C
    Configure SyncDaemon with the Microsoft Graph Delegated permission User.Read.All and authenticate using a user-assigned managed identity to bypass the admin consent requirement.
  4. D
    Configure UserPortal to acquire a Shared Access Signature (SAS) token with User.Read scope from the Microsoft identity platform to authenticate to the custom web API.

Cevap

Configure SyncDaemon with the Microsoft Graph Application permission User.Read.All with tenant admin consent, and configure UserPortal with the Microsoft Graph Delegated permission User.Read and a custom scope on the custom web API registration.
The background service SyncDaemon has no signed-in user context and therefore requires Application permissions (User.Read.All) which always require tenant admin consent. The Single Page Application UserPortal operates in a user context, requiring Delegated permissions (User.Read), and accesses the custom web API using a custom scope registered on the target API's registration in Microsoft Entra ID.

Adım Adım Çözüm

1
Determine the application type and user context for SyncDaemon.
SyncDaemon is identified as a daemon application running without user interaction.
This establishes that Application permissions (rather than Delegated permissions) must be used, which consequently requires tenant admin consent.
2
Determine the application type and user context for UserPortal.
UserPortal is identified as a Single Page Application (SPA) where users sign in.
This establishes that Delegated permissions must be used because operations are performed on behalf of the signed-in user.
3
Select the correct permission scopes and authentication mechanism for accessing the custom web API.
A custom scope exposed on the API application registration is defined using the App ID URI prefix.
This allows the SPA to request a token specifically scoped for the custom web API using Entra ID, rather than relying on storage-specific mechanisms like Shared Access Signatures.

Anahtar Kavram

Microsoft Entra ID Application vs. Delegated Permissions and API Scopes
Bu soruyu puanla

Konular

Permissions, Scopes, and Consent

Bu konudan daha fazla soru