nerdexam
Microsoft

AZ-500 · Question #298

You have an Azure subscription that contains an app named App1. App1 has the app registration shown in the following table. You need to ensure that App1 can read all user calendars and create…

The correct answer is B. Add a new Application API permission for Microsoft.Graph Calendars.ReadWrite. To enable an application to read and create appointments for all user calendars using the principle of least privilege, you must add an Application API permission for Microsoft.Graph Calendars.ReadWrite.

Submitted by ravi_2018· Mar 6, 2026Secure identity and access

Question

You have an Azure subscription that contains an app named App1. App1 has the app registration shown in the following table. You need to ensure that App1 can read all user calendars and create appointments. The solution must use the principle of least privilege. What should you do?

Exhibits

AZ-500 question #298 exhibit 1
AZ-500 question #298 exhibit 2

Options

  • AAdd a new Delegated API permission for Microsoft.Graph Calendars.ReadWrite.
  • BAdd a new Application API permission for Microsoft.Graph Calendars.ReadWrite.
  • CSelect Grant admin consent.
  • DAdd a new Delegated API permission for Microsoft.Graph Calendars.ReadWrite.Shared.

How the community answered

(60 responses)
  • A
    20% (12)
  • B
    70% (42)
  • C
    3% (2)
  • D
    7% (4)

Why each option

To enable an application to read and create appointments for all user calendars using the principle of least privilege, you must add an Application API permission for Microsoft.Graph Calendars.ReadWrite.

AAdd a new Delegated API permission for Microsoft.Graph Calendars.ReadWrite.

A Delegated API permission for Calendars.ReadWrite allows the app to act on behalf of a signed-in user, granting access only to that user's calendar, not 'all user calendars' in the organization.

BAdd a new Application API permission for Microsoft.Graph Calendars.ReadWrite.Correct

An Application API permission (app-only permission) for Calendars.ReadWrite allows the application itself to read and write all calendars in the organization without a signed-in user context. This scope is necessary to fulfill the requirement of accessing 'all user calendars' and 'create appointments'.

CSelect Grant admin consent.

Selecting 'Grant admin consent' is an action taken after permissions are added to consent to them, it is not a permission itself or the first step to add the required permission.

DAdd a new Delegated API permission for Microsoft.Graph Calendars.ReadWrite.Shared.

A Delegated API permission for Calendars.ReadWrite.Shared only allows the app to access calendars that the signed-in user has shared or has access to, which does not cover 'all user calendars' and still requires a signed-in user.

Concept tested: Microsoft Graph permissions, delegated vs. application permissions

Source: https://learn.microsoft.com/en-us/graph/permissions-reference#calendar-permissions

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full AZ-500 Practice