Your company has an Azure subscription named Sub1 that is associated to an Azure Active Directory (Azure AD) tenant named contoso.com. The company develops an application named App1. App1 is…

Question

Options

• Aan application permission without admin consent
• Ba delegated permission without admin consent
• Ca delegated permission that requires admin consent
• Dan application permission that requires admin consent

• A
  3% (1)
• B
  92% (36)
• C
  5% (2)

Explanation

Explanation

Option B is correct because a delegated permission allows App1 to access Azure Key Vault on behalf of a signed-in user, meaning the app acts with the user's identity and can only access what the user themselves is authorized to access - and since reading Key Vault secrets is not a highly privileged operation requiring organizational approval, admin consent is not required.

Option A is wrong because an application permission (not delegated) means the app acts as itself with no user context - this contradicts the requirement of acting "on behalf of users." Option D fails for the same reason, and the requirement for admin consent makes it unnecessarily restrictive. Option C is wrong because while delegated permissions are correct, admin consent is not required here - Key Vault secret access on behalf of a user does not require tenant-wide admin approval, making it an unnecessary barrier.

Memory Tip: Think "Delegated = acts on behalf of a Delegate (the user)" vs. "Application = acts as itself (no user involved)." For "on behalf of" scenarios, always start with delegated permissions, and only add admin consent if the permission involves sensitive organizational data or privileged operations.

No community discussion yet for this question.