You are developing a background daemon service that will run on an on-premises server. The service must periodically scan all user mailboxes in your organization's Microsoft Entra ID tenant and archive email attachments to Azure Blob Storage. The service will run in the background without any user interaction or sign-in.
You register the application in Microsoft Entra ID. You need to configure the API permissions and authentication requirements.
Which two actions should you perform to configure the application registration and permissions? (Select two.)
- Configure the application registration with the Mail.Read Application permission for the Microsoft Graph API.Cevap
- Grant tenant-wide admin consent for the configured Microsoft Graph API permission.Cevap
- CConfigure the application registration with the Mail.Read Delegated permission for the Microsoft Graph API.
- DConfigure the on-premises server to authenticate using a user-assigned managed identity.
- EConfigure the application registration to use a Shared Access Signature (SAS) token for authentication to the Microsoft Graph API.
Cevap
The correct actions are to configure the application registration with the Mail.Read Application permission for the Microsoft Graph API and to grant tenant-wide admin consent for the configured Microsoft Graph API permission.
A background daemon service runs without a user context. Therefore, it requires Application permissions instead of Delegated permissions to access resources like mailboxes. Furthermore, since Application permissions allow broad access to all resources of that type in the tenant, they must be approved by a directory administrator via tenant-wide admin consent.
Adım Adım Çözüm
Anahtar Kavram
App Registrations, Service Principals, and Application vs Delegated Permissions
Tahmini Süre:2m 0s