SC-300 · Question #125
Drag and Drop Question Your company has an Azure Active Directory (Azure AD) tenant named contoso.com. The company is developing a web service named App1. You need to ensure that App1 can use…
The correct answer is Create an app registration.; Add app permissions.; Grant admin consent. To allow App1 (a web service/daemon) to use Microsoft Graph to read directory data, you must first register the application in Azure AD to establish its identity. Next, you add app permissions (application permissions, not delegated) because App1 runs as a service without a…
Question
Exhibit
Answer Area
Drag items
Correct arrangement
- Create an app registration.
- Add app permissions.
- Grant admin consent.
Explanation
To allow App1 (a web service/daemon) to use Microsoft Graph to read directory data, you must first register the application in Azure AD to establish its identity. Next, you add app permissions (application permissions, not delegated) because App1 runs as a service without a signed-in user, requiring application-level Microsoft Graph permissions like 'Directory.Read.All'. Finally, an administrator must grant admin consent because application permissions that access directory data are high-privilege and cannot be self-consented by users.
Topics
Community Discussion
No community discussion yet for this question.