Microsoft SC-300 Bundle

When a developer attempts to use a delegated permission token from a client-credentials flow, Choose app-only permissions rather than user-delegated scopes for the daemon is justified because delegated scopes require a user context; client credentials issue application-context tokens; here the issue is the API needs a named permission scope for user-delegated reads of account summaries, and Define an exposed delegated API scope and grant the client appropriate consent addresses that distinction.

Verify consented application permissions and the service principal's granted app roles concerns an application token lacks the Graph role despite a requested permission, where merely requesting a permission in registration does not supply an effective tenant consent grant; the current scenario instead requires the API needs a named permission scope for user-delegated reads of account summaries, so Define an exposed delegated API scope and grant the client appropriate consent is a closer fit.

Although Validate the token audience, issuer, signature, and authorization claims at the API fits the security team wants the API to reject a token issued for a different service (a successful identity-provider token exchange does not grant cross-audience access to another API), it is not the necessary control for the API needs a named permission scope for user-delegated reads of account summaries. Select Define an exposed delegated API scope and grant the client appropriate consent.

Validate the token audience, issuer, signature, and authorization claims at the API concerns the security team wants the API to reject a token issued for a different service, where a successful identity-provider token exchange does not grant cross-audience access to another API; the current scenario instead requires a background settlement daemon must call the API with no signed-in user, so Configure an application permission or app role and an approved client-credentials flow is a closer fit.

The distinct mechanism for Register the correct web redirect URI in the app's authentication configuration is that strict redirect URI matching prevents tokens or authorization codes being returned to arbitrary endpoints; this handles the web client must redirect authorization responses to one verified application callback rather than a background settlement daemon must call the API with no signed-in user, so use Configure an application permission or app role and an approved client-credentials flow.

Although Request an approved delegated API scope from the frontend application fits the frontend needs to call the backend API in the logged-in clinician's context (delegated permissions enable an application call representing the current user where authorized), it is not the necessary control for a background settlement daemon must call the API with no signed-in user. Select Configure an application permission or app role and an approved client-credentials flow.

The distinct mechanism for Inspect the app registration manifest and authentication settings is that app registration metadata documents the protocol configuration independently of enterprise service principal assignments; this handles the team wants the application name and redirect URIs visible during audit review rather than the security team wants the API to reject a token issued for a different service, so use Validate the token audience, issuer, signature, and authorization claims at the API.

Define an exposed delegated API scope and grant the client appropriate consent would support the different situation where the API needs a named permission scope for user-delegated reads of account summaries: a delegated scope lets a client request user-context access to a protected API; however it does not resolve the security team wants the API to reject a token issued for a different service, which calls for Validate the token audience, issuer, signature, and authorization claims at the API.

Strict redirect URI matching prevents tokens or authorization codes being returned to arbitrary endpoints, which makes Register the correct web redirect URI in the app's authentication configuration appropriate when the web client must redirect authorization responses to one verified application callback; here the task is the security team wants the API to reject a token issued for a different service, requiring Validate the token audience, issuer, signature, and authorization claims at the API.

Although Validate scp for delegated tokens and roles for applicable application tokens fits a developer confuses the OAuth scopes claim with an app-only roles claim (different grant types express authorization through different token claim conventions), it is not the necessary control for the app is limited to accounts in the university tenant. Select Set the appropriate single-tenant supported account type in the app registration.

Changing an exposed API identity can invalidate the audience or permission names expected by clients, which makes Review the registered API identifier and client requested audience or scopes appropriate when the developers change the application ID URI and API clients start failing; here the task is the app is limited to accounts in the university tenant, requiring Set the appropriate single-tenant supported account type in the app registration.

When a web server holds a client secret securely and requests tokens in a back-channel exchange, Configure the appropriate confidential web application auth flow and credentials is justified because confidential clients can authenticate to the token endpoint in a way public clients cannot; here the issue is the app is limited to accounts in the university tenant, and Set the appropriate single-tenant supported account type in the app registration addresses that distinction.

Inspect the app registration manifest and authentication settings would support the different situation where the team wants the application name and redirect URIs visible during audit review: app registration metadata documents the protocol configuration independently of enterprise service principal assignments; however it does not resolve the vendor plans to let users from outside Entra tenants sign in through the same registration, which calls for Review the supported account-type and multitenant consent design before changing it.

OBO carries an authenticated user's delegated authority across an API tier rather than switching to app-only rights, which makes Use a supported OAuth on-behalf-of flow with the necessary downstream delegated scopes appropriate when the backend calls a second protected API on behalf of the same clinician; here the task is the vendor plans to let users from outside Entra tenants sign in through the same registration, requiring Review the supported account-type and multitenant consent design before changing it.

Remove unused credentials and retire the registration after checking dependencies concerns the legacy application registration has no active clients but retains live credentials, where abandoned app identities can preserve usable secrets even after the visible application is gone; the current scenario instead requires the vendor plans to let users from outside Entra tenants sign in through the same registration, so Review the supported account-type and multitenant consent design before changing it is a closer fit.

Supported account type controls which identity tenants can authenticate to the application, which makes Set the appropriate single-tenant supported account type in the app registration appropriate when the app is limited to accounts in the university tenant; here the task is the developers change the application ID URI and API clients start failing, requiring Review the registered API identifier and client requested audience or scopes.

When the legacy application registration has no active clients but retains live credentials, Remove unused credentials and retire the registration after checking dependencies is justified because abandoned app identities can preserve usable secrets even after the visible application is gone; here the issue is the developers change the application ID URI and API clients start failing, and Review the registered API identifier and client requested audience or scopes addresses that distinction.

Complete authorized consent in the franchise tenant for the necessary permissions concerns a franchise tenant has not granted permission to the requested application API scopes, where a publisher's registration does not grant API access inside every customer tenant automatically; the current scenario instead requires the developers change the application ID URI and API clients start failing, so Review the registered API identifier and client requested audience or scopes is a closer fit.

When auditors need proof of who approved the application's elevated Graph consent, Review admin consent grant records and app-related directory audit activity is justified because permission grants should be traceable to an authorized consenting administrator; here the issue is the team wants the application name and redirect URIs visible during audit review, and Inspect the app registration manifest and authentication settings addresses that distinction.

Review the supported account-type and multitenant consent design before changing it concerns the vendor plans to let users from outside Entra tenants sign in through the same registration, where a multitenant app has broader issuer and consent requirements than an internal single-tenant app; the current scenario instead requires the team wants the application name and redirect URIs visible during audit review, so Inspect the app registration manifest and authentication settings is a closer fit.

Although Validate the token audience, issuer, signature, and authorization claims at the API fits the security team wants the API to reject a token issued for a different service (a successful identity-provider token exchange does not grant cross-audience access to another API), it is not the necessary control for the team wants the application name and redirect URIs visible during audit review. Select Inspect the app registration manifest and authentication settings.

Review admin consent grant records and app-related directory audit activity concerns auditors need proof of who approved the application's elevated Graph consent, where permission grants should be traceable to an authorized consenting administrator; the current scenario instead requires the job must read approved directory objects without an interactive employee present, so Request the supported Graph application permissions with an authorized admin consent process is a closer fit.

Although Validate approved token issuers and tenant authorization in addition to signature and audience fits a developer assumes a valid token from any tenant should be accepted by its API (multitenant token issuance broadens authentication sources; APIs must still authorize the calling tenant), it is not the necessary control for the job must read approved directory objects without an interactive employee present. Select Request the supported Graph application permissions with an authorized admin consent process.

Choose app-only permissions rather than user-delegated scopes for the daemon would support the different situation where a developer attempts to use a delegated permission token from a client-credentials flow: delegated scopes require a user context; client credentials issue application-context tokens; however it does not resolve the job must read approved directory objects without an interactive employee present, which calls for Request the supported Graph application permissions with an authorized admin consent process.

The distinct mechanism for Define an exposed delegated API scope and grant the client appropriate consent is that a delegated scope lets a client request user-context access to a protected API; this handles the API needs a named permission scope for user-delegated reads of account summaries rather than a developer attempts to use a delegated permission token from a client-credentials flow, so use Choose app-only permissions rather than user-delegated scopes for the daemon.

Although Request the supported Graph application permissions with an authorized admin consent process fits the job must read approved directory objects without an interactive employee present (application permissions operate as the service principal and do not depend on a signed-in user), it is not the necessary control for a developer attempts to use a delegated permission token from a client-credentials flow. Select Choose app-only permissions rather than user-delegated scopes for the daemon.

Use proper token validation and credential proof; treat the client ID as public metadata would support the different situation where a developer wants to treat the app client ID as a secret for access control: an application ID identifies the client but cannot authenticate it by itself; however it does not resolve a developer attempts to use a delegated permission token from a client-credentials flow, which calls for Choose app-only permissions rather than user-delegated scopes for the daemon.

Although Define an application role and assign it to the approved client service principal fits a backend client must receive a role claim granting read-only access to API records (app roles express API-level authorization that the API can validate in access token claims), it is not the necessary control for the service principal has Directory.ReadWrite.All but only needs to inspect a small identity subset. Select Reduce API permissions and scope operations using the supported granular controls.

Review admin consent grant records and app-related directory audit activity would support the different situation where auditors need proof of who approved the application's elevated Graph consent: permission grants should be traceable to an authorized consenting administrator; however it does not resolve the service principal has Directory.ReadWrite.All but only needs to inspect a small identity subset, which calls for Reduce API permissions and scope operations using the supported granular controls.

A delegated scope expresses user-context rights, not an automatic promise that all application data is visible, which makes Expose a delegated scope and use the signed-in user's effective entitlement checks appropriate when a front-end app needs a per-user permission to view only their authorized resource records; here the task is the service principal has Directory.ReadWrite.All but only needs to inspect a small identity subset, requiring Reduce API permissions and scope operations using the supported granular controls.

Reduce API permissions and scope operations using the supported granular controls would support the different situation where the service principal has Directory.ReadWrite.All but only needs to inspect a small identity subset: excessively broad application grants create unnecessary tenant-wide identity exposure; however it does not resolve auditors need proof of who approved the application's elevated Graph consent, which calls for Review admin consent grant records and app-related directory audit activity.

Tenant-local service principal permissions can be withdrawn without editing the publisher's app registration, which makes Remove the applicable enterprise application consent or app assignment in the customer tenant appropriate when the customer wants to revoke the vendor application's tenant-local permission grants; here the task is auditors need proof of who approved the application's elevated Graph consent, requiring Review admin consent grant records and app-related directory audit activity.

When the job must read approved directory objects without an interactive employee present, Request the supported Graph application permissions with an authorized admin consent process is justified because application permissions operate as the service principal and do not depend on a signed-in user; here the issue is auditors need proof of who approved the application's elevated Graph consent, and Review admin consent grant records and app-related directory audit activity addresses that distinction.