AZ-500 Question 25
Single answerYour organization has developed a new enterprise application that requires delegated permissions (Mail.Read) to read all users’ mailboxes in Microsoft Entra ID. By default, users are able to grant this permission when signing into the app. However, the company’s security policy mandates that only administrators can grant organization-wide permissions. You need to ensure that end users cannot grant these high-level OAuth permissions themselves. Which action should you take to meet this requirement?
- A
Disable user consent for delegated permissions in User consent settings and enable the Admin consent workflow for high-privilege permissions.
- B
Enable conditional access policies to block sign-ins if the application requests any delegated permissions related to mail.
- C
Request that each end user deny the OAuth prompt and escalate the access request to a security administrator.
- D
Create a custom Client Secret in the application registration and assign the Mail.Read scope to individual users manually.
Show answer and explanation
Correct answer: A
Explanation
Under Microsoft Entra ID (formerly Azure AD) best practices, administrators can use the consent and permissions settings to disable end-user consent for apps requesting privileged OAuth scopes. When 'User consent for apps' is set to 'Do not allow user consent' or restricted to low-impact permissions, and the Admin consent workflow is enabled, only an authorized administrator can grant high-privilege permissions like Mail.Read on behalf of the entire organization. Refer to Microsoft’s documentation on enterprise application consent policies and the Admin consent workflow for detailed guidance.
- A. Correct.
Correct. Disabling user consent in the tenant’s consent settings prevents non-admin users from granting high-privilege permissions. Enabling the Admin consent workflow then requires approval from an administrator for organization-wide permissions such as Mail.Read for all mailboxes. This setup is recommended for controlling sensitive data access.
- B. Incorrect.
Incorrect. Conditional access policies control sign-in risks or access conditions, not the OAuth permission consent process. While conditional access is useful for security, it does not replace the need to regulate delegated permission grants properly.
- C. Incorrect.
Incorrect. Relying on end users to deny prompts is not a reliable or scalable strategy. The organization-wide setting must be configured to prevent user consent for high-privilege permissions, rather than relying on voluntary action by each user.
- D. Incorrect.
Incorrect. Creating a client secret and manually assigning the Mail.Read scope to each user does not prevent unauthorized consent. This approach also fails to meet the requirement that only administrators can grant organization-wide permissions.