You have an Azure subscription that contains an Azure Active Directory (Azure AD) tenant and a user named User1. The App registrations settings for the tenant are configured as shown in the…

Question

Options

• AApp Configuration Data Owner for the subscription
• BManaged Application Contributor for the subscription
• CCloud application administrator in Azure AD
• DApplication developer in Azure AD

• A
  6% (2)
• B
  3% (1)
• C
  8% (3)
• D
  83% (30)

Explanation

Explanation

Option D (Application Developer in Azure AD) is correct because the exhibit shows that "Users can register applications" is set to No, meaning standard users cannot register apps by default. The Application Developer role grants only the ability to register applications in Azure AD, perfectly satisfying the principle of least privilege - it gives User1 exactly what they need and nothing more.

Why the distractors are wrong:

• Option A (App Configuration Data Owner) is an Azure RBAC role for managing App Configuration store data (key-value pairs), not for registering Azure AD applications - completely unrelated.
• Option B (Managed Application Contributor) allows users to create managed application resources in Azure, not register apps in Azure AD - different concept entirely.
• Option C (Cloud Application Administrator) can register apps, but also carries additional privileges like managing enterprise applications and SSO settings, violating the principle of least privilege.

Memory Tip

Think of it this way: "Developer registers, Administrator manages." When you just need to register an app - the minimum possible task - reach for Application Developer. Cloud Application Administrator is the "heavier" role that does much more than just registration. When you see "least privilege + register app," always think Application Developer.

No community discussion yet for this question.