nerdexam
Microsoft

AZ-500 · Question #56

Drag and Drop Question Your company has an Azure Active Directory (Azure AD) tenant named contoso.com. The company is developing an application named App1. App1 will run as a service on server that…

The correct answer is Create an app registration.; Add an application permission.; Grant permissions. The correct sequence is: (1) Create an app registration to register App1 in Azure AD, giving it an identity within the tenant. (2) Add an application permission (not delegated) because App1 runs as a background service with no signed-in user, so it needs app-level permissions…

Submitted by deeparc· Mar 6, 2026Implement and manage application access and permissions in Azure Active Directory (Manage identities and governance / Identity and Access Management)

Question

Drag and Drop Question Your company has an Azure Active Directory (Azure AD) tenant named contoso.com. The company is developing an application named App1. App1 will run as a service on server that runs Windows Server 2016. App1 will authenticate to contoso.com and access Microsoft Graph to read directory data. You need to delegate the minimum required permissions to App1. Which three actions should you perform in sequence from the Azure portal? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order. Answer:

Exhibit

AZ-500 question #56 exhibit

Answer Area

Drag items

Grant permissionsAdd a delegated permission.Configure Azure AD Application Proxy.Add an application permission.Create an app registration.

Correct arrangement

  • Create an app registration.
  • Add an application permission.
  • Grant permissions

Explanation

The correct sequence is: (1) Create an app registration to register App1 in Azure AD, giving it an identity within the tenant. (2) Add an application permission (not delegated) because App1 runs as a background service with no signed-in user, so it needs app-level permissions to access Microsoft Graph directory data autonomously. (3) Grant permissions (admin consent) to authorize the application permission, which is required since application permissions always need admin consent before they can be used.

Topics

#Azure AD App Registration#Microsoft Graph Permissions#Application vs Delegated Permissions#Service Principal / Daemon Apps

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full AZ-500 Practice