Examkin

Soru

Zorluk: KolayPermissions, Scopes, and Consent

You are developing a web application where users must log in using their corporate accounts. After logging in, the application needs to read the profile details of the currently signed-in user from Microsoft Graph. Which type of permission should you configure for the Microsoft Graph API in the Microsoft Entra ID application registration?

  1. Delegated permissionsCevap
  2. B
    Application permissions
  3. C
    Shared Access Signature permissions
  4. D
    Key Vault access policies

Cevap

Delegated permissions
The correct answer is delegated permissions because they are specifically designed for scenarios where an application runs with an active, signed-in user and acts on their behalf. This ensures that the application cannot access any resource that the signed-in user themselves does not have permission to access.

Adım Adım Çözüm

1
Analyze the application requirements.
The application requires a user to sign in and needs to access Microsoft Graph API resources on behalf of that signed-in user.
Identifying if a user context exists helps determine the correct permission model.
2
Select the appropriate Microsoft Entra ID permission type.
Delegated permissions are selected because they operate in the context of a signed-in user, enforcing the permissions of both the user and the application.
Delegated permissions allow the application to act on behalf of the signed-in user, whereas application permissions are for daemon services running without user context.

Anahtar Kavram

Delegated versus Application permissions in Microsoft Entra ID
Bu soruyu puanla

Konular

Permissions, Scopes, and Consent

Bu konudan daha fazla soru