Hotspot Question You have a hybrid Microsoft 365 subscription that contains the users shown in the following table. You plan to deploy an on-premises app named App1. App1 will be registered in Azure A

Question

Exhibit

Answer Area

• User that should perform the installation:Admin2
  Admin1Admin2Admin3Admin4
• Assign User1 the role of:Cloud Application Administrator
  Application AdministratorApplication DeveloperCloud Application AdministratorGlobal Administrator

• Admin1|Application Administrator
  100% (1)

Explanation

To deploy an Azure AD Application Proxy with least privilege, an Application Administrator should install the connector, and an Application Developer role should be assigned for application registration.

Approach. The question requires identifying the user for Application Proxy connector installation and the role for User1 to register an application, both adhering to the principle of least privilege.

1. User that should perform the installation: The Azure AD Application Proxy connector installation requires permissions to register the connector with the Azure AD tenant. According to Microsoft documentation, both Global Administrator and Application Administrator roles have the necessary permissions. Among the given options, Admin1 is a Global Administrator and Admin2 is an Application Administrator. To adhere to the principle of least privilege, Admin2 (Application Administrator) should be selected as this role has sufficient permissions without granting excessive privileges like Global Administrator.

2. Assign User1 the role of: User1 needs to 'register App1 in Azure AD'. This refers to creating an application registration in Azure AD. The Application Developer role is specifically designed to allow users to register and manage applications they own. While Application Administrator and Cloud Application Administrator roles also permit application registration, they grant broader management permissions across all applications in the tenant. To ensure User1 can register App1 with the least privilege, Application Developer should be assigned.

Common mistakes.

• common_mistake. 1. Selecting Admin1 (Global Administrator) for installation: Although a Global Administrator can install the Application Proxy connector, it violates the principle of least privilege when an Application Administrator (Admin2) is sufficient for this specific task.

1. Selecting Admin3 (Cloud Application Administrator) or Admin4 (Application Developer) for installation: These roles do not possess the necessary permissions to install and manage Azure AD Application Proxy connectors.
2. Assigning User1 the Application Administrator, Cloud Application Administrator, or Global Administrator role: While these roles would allow User1 to register App1, they grant significantly more permissions than required for the sole task of 'registering an application.' For instance, 'Cloud Application Administrator' can manage all application registrations and enterprise applications, which is more privileged than simply allowing a user to register an application they are responsible for. The 'Application Developer' role is the most granular and least privileged option for just registering an application, hence selecting a higher-privileged role violates the principle of least privilege.

Concept tested. This question primarily tests knowledge of Azure AD built-in roles, specifically their permissions related to Azure AD Application Proxy management and application registration. It heavily emphasizes the principle of least privilege (PoLP) in assigning roles.

Reference. https://learn.microsoft.com/en-us/azure/active-directory/roles/permissions-reference https://learn.microsoft.com/en-us/azure/active-directory/app-proxy/application-proxy-connectors#permissions

No community discussion yet for this question.