Examkin

Soru

Zorluk: OrtaPermissions, Scopes, and Consent

You are developing a background daemon service named DataArchiver that runs on a schedule to back up documents from all user OneDrive libraries to an Azure Blob Storage container. The service must authenticate silently without any user interaction.

You register DataArchiver in Microsoft Entra ID. You need to configure the permissions for Microsoft Graph to allow the service to read the files.

Which configuration should you apply to the application registration to meet the requirements while adhering to the principle of least privilege?

  1. Configure Microsoft Graph Application permissions for Files.Read.All, and obtain tenant-wide admin consent.Cevap
  2. B
    Configure Microsoft Graph Delegated permissions for Files.Read.All, and have each user log in once to consent to the permissions.
  3. C
    Configure Microsoft Graph Delegated permissions for Files.Read.All, and configure a Shared Access Signature (SAS) token on the target storage account to delegate user authority.
  4. D
    Configure Microsoft Graph Application permissions for Files.Read.All, and configure a Shared Access Signature (SAS) token in the application registration settings to authorize the client credentials.

Cevap

Configure Microsoft Graph Application permissions for Files.Read.All, and obtain tenant-wide admin consent.
The correct configuration is to use Microsoft Graph Application permissions for Files.Read.All and obtain tenant-wide admin consent. Because the daemon runs as a background service without a signed-in user, it must authenticate as its own identity using Application permissions rather than Delegated permissions. Additionally, reading data across all users' OneDrive libraries is a high-privilege operation that requires tenant-wide admin consent.

Adım Adım Çözüm

1
Determine the authentication context and identity flow.
Since the service runs silently on a schedule with no user interaction, it must use the client credentials flow with Application permissions instead of Delegated permissions.
Delegated permissions require an active user session, whereas Application permissions allow a daemon or service to run autonomously.
2
Identify the Microsoft Graph permission required to read all users' OneDrive files.
The minimum permission needed to read files across all user libraries is Files.Read.All.
Following the principle of least privilege, Files.Read.All provides read access to all files, which is sufficient for backup purposes without granting write or delete privileges.
3
Determine the consent requirement.
Obtain tenant-wide admin consent for the Files.Read.All Application permission.
Application permissions that access organization-wide data (like Files.Read.All) cannot be consented to by regular users and require an administrator to grant consent tenant-wide.

Anahtar Kavram

Configuring Application Permissions and Consent for Daemon Apps
Tahmini Süre:1m 30s
Bu soruyu puanla

Konular

Permissions, Scopes, and Consent

Bu konudan daha fazla soru