You are developing a daemon application named 'BillingJob' that runs nightly as a background service on an Azure Virtual Machine. The application must query Microsoft Graph to retrieve the profile details of all users in the Microsoft Entra ID tenant to generate monthly billing reports. No user is signed in when the application runs.
You need to configure the permissions for the application registration in Microsoft Entra ID while adhering to the principle of least privilege.
Which configuration should you implement?
- Add the Microsoft Graph User.Read.All Application permission to the application registration, and grant admin consent for the tenant.Cevap
- BAdd the Microsoft Graph User.Read.All Delegated permission to the application registration, and have users consent to the permission when they next sign in.
- CAdd the Microsoft Graph Directory.Read.All Delegated permission to the application registration, and grant admin consent for the tenant.
- DGenerate a Shared Access Signature (SAS) token with directory-level read scope, and store it in Azure Key Vault for the application to authenticate against Microsoft Graph.
Cevap
Add the Microsoft Graph User.Read.All Application permission to the application registration, and grant admin consent for the tenant.
Because the application runs as a background daemon service without user interaction, it cannot acquire a user context and must use Application permissions. The User.Read.All permission allows reading full user profiles for all accounts, and because it is an Application permission, it requires tenant administrator consent. This satisfies the requirement using the principle of least privilege.
Adım Adım Çözüm
Anahtar Kavram
Daemon applications running without user context must use Application permissions and require admin consent for directory-wide scopes.