Examkin

Soru

Zorluk: OrtaPermissions, Scopes, and Consent

An organization is implementing a client-side Single Page Application (SPA) named ClientConnect. The application must authenticate users using Microsoft Entra ID and access a secure downstream web API named DataAPI on behalf of the signed-in user. The DataAPI exposes a custom scope named Data.Write.

You register both ClientConnect and DataAPI in Microsoft Entra ID.

Which two configuration steps should you perform in Microsoft Entra ID to implement the required permissions and consent? Select two.

  1. In the App Registration for ClientConnect, add the custom scope Data.Write from DataAPI as a Delegated permission.Cevap
  2. In the App Registration for DataAPI, define the custom scope Data.Write under the Expose an API section.Cevap
  3. C
    Generate a Shared Access Signature (SAS) token with write permissions and configure ClientConnect to include it in requests to DataAPI.
  4. D
    In the App Registration for ClientConnect, add the custom scope Data.Write from DataAPI as an Application permission.

Cevap

In the App Registration for ClientConnect, add the custom scope Data.Write from DataAPI as a Delegated permission; and in the App Registration for DataAPI, define the custom scope Data.Write under the Expose an API section.
To access the custom downstream web API on behalf of a signed-in user, two configurations must be met: First, the target web API (DataAPI) must expose the scope by defining it in the Expose an API section. Second, the client application (ClientConnect) must request access by adding that scope as a Delegated permission. This maintains the user context flow.

Adım Adım Çözüm

1
Expose the custom scope in the downstream API registration.
The Data.Write scope is defined in the registration of DataAPI, allowing other applications to request it.
Before a client can request permissions for a custom API, the API must explicitly declare the scopes it supports.
2
Add the exposed scope as a Delegated permission to the client application registration.
ClientConnect is configured with a delegated permission to request Data.Write on behalf of the signed-in user.
Since ClientConnect is a Single Page Application running in the context of the user, it requires delegated permissions to act on the user's behalf.

Anahtar Kavram

Delegated permissions and custom API scopes in Microsoft Entra ID
Bu soruyu puanla

Konular

Permissions, Scopes, and Consent

Bu konudan daha fazla soru