Which permission should you grant for each feature?

Question Set 2

HOTSPOT

You are developing an interactive invoicing application that will be used by end users.

The application will have the following features:

– Save invoices generated by a user to the user’s Microsoft OneDrive.

– Email daily automated reminders.

You need to identify which permissions to grant for the application features. The solution must use the principle of least privilege.

Which permission should you grant for each feature? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

View Answer

Answer:

Explanation:

Microsoft identity platform supports two types of permissions:

delegated permissions and application permissions.

Box 1: Delegated

– Delegated permissions are used by apps that have a signed-in user present. For these apps, either the user or an administrator consents to the permissions that the app requests, and the app is delegated permission to act as the signed-in user when making calls to the target resource.

Box 2: Application

– Application permissions are used by apps that run without a signed-in user present; for example, apps that run as background services or daemons. Application permissions can only be consented by an administrator.

Reference: https://docs.microsoft.com/en-us/azure/active-directory/develop/v2-permissions-and-consent