nerdexam
Microsoft

AZ-204 · Question #210

Drag and Drop Question You are developing an ASP.NET Core website that can be used to manage photographs which are stored in Azure Blob Storage containers. Users of the website authenticate by using t

The correct answer is user_impersonation; delegated; delegated. The correct configuration requires 'user_impersonation' as the API permission scope for Azure Blob Storage, which allows the application to access Azure Storage on behalf of the signed-in user. The permission type must be set to 'delegated' (not 'application') because the website

Submitted by ahmad_uae· Mar 30, 2026Implement Azure security - Configure authentication and authorization using Azure AD, including registering applications, configuring API permissions (delegated vs. application), and integrating RBAC with Azure Storage for user-delegated access scenarios.

Question

Drag and Drop Question You are developing an ASP.NET Core website that can be used to manage photographs which are stored in Azure Blob Storage containers. Users of the website authenticate by using their Azure Active Directory (Azure AD) credentials. You implement role-based access control (RBAC) role permissions on the containers that store photographs. You assign users to RBAC roles. You need to configure the website's Azure AD Application so that user's permissions can be used with the Azure Blob containers. How should you configure the application? To answer, drag the appropriate setting to the correct location. Each setting can be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content. NOTE: Each correct selection is worth one point. Answer:

Exhibit

AZ-204 question #210 exhibit

Answer Area

Drag items

client_idprofiledelegatedapplicationuser_impersonation

Correct arrangement

  • user_impersonation
  • delegated
  • delegated

Explanation

The correct configuration requires 'user_impersonation' as the API permission scope for Azure Blob Storage, which allows the application to access Azure Storage on behalf of the signed-in user. The permission type must be set to 'delegated' (not 'application') because the website needs to act on behalf of the authenticated user, respecting their individual RBAC role assignments on the blob containers. Using delegated permissions ensures that users can only access what their own RBAC roles permit, rather than granting the app blanket access regardless of user identity.

Topics

#Azure Active Directory#Azure Blob Storage RBAC#OAuth 2.0 Delegated Permissions#ASP.NET Core Authentication

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full AZ-204 Practice