Are you a guardian of your domain? Lean how to leverage your aptitude in security to protect Microsoft Azure technologies, with a goal of earning the Microsoft Certified: Azure Security Engineer Associate certification!
Prepare and test your skills
Prepare and test your skills
Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.
A security-conscious organization is developing a critical backend daemon service that requires unattended access to Microsoft Graph. This service needs to perform two distinct, high-privilege operations:
The organization's security policy strictly enforces the principle of least privilege and mandates that all necessary permissions for this daemon service must be granted through admin consent.
Which configuration approach correctly defines the required permissions and ensures they are granted appropriately for this application?
Keep the momentum going with these hand-picked practice scenarios
Want more questions like this?
Get a free certification question every week.
Application permissions, also known as app roles, are a type of permission used when an application needs to access data or perform actions without a signed-in user present. This is typical for daemon services, background processes, or automated tasks where the application acts on its own identity. When an application is granted an application permission, it has the ability to access any data associated with that permission across the entire tenant, independent of any individual user's privileges.
Admin consent is the process by which a global administrator (or other authorized administrator) grants permissions to an application on behalf of all users in the tenant. This is typically required for high-privilege permissions, application permissions, or when user consent has been restricted. Admin consent ensures that the organization maintains control over which applications can access sensitive data or perform broad actions.
This approach directly addresses all the requirements outlined in the scenario:
StudyCerts
StudyCertsUser.Read.All and Mail.Send as Application permissions, the service can operate without a signed-in user, fulfilling the daemon service requirement.User.Read.All application permission grants the service the ability to read the full profile details for all users in the Microsoft Entra tenant, as required.Mail.Send application permission allows the service to send emails, which can be configured to originate from a specific shared mailbox, meeting the requirement for sending emails without user interaction.User.Read.All provides read-only access to user profiles, and Mail.Send provides only the ability to send mail, not read it. These are the least privileged application permissions for the specified tasks, adhering to the security policy.User.Read.All and Mail.Send, the application is granted only the necessary access, minimizing potential risk.This configuration is optimal because it precisely matches the technical requirements of a daemon service needing app-only access to specific Microsoft Graph functionalities, while strictly adhering to the security mandates of least privilege and admin consent. Using application permissions ensures the service can run autonomously, and the specific permissions chosen (User.Read.All, Mail.Send) are tailored to the exact operations, avoiding over-privileging the application. The explicit requirement for admin consent is also directly satisfied by this method.