AZ-500 Question 28
Select 2Your organization has created a line-of-business web application that uses the OAuth 2.0 authorization code flow to sign in users through Microsoft Entra ID. You have registered the application in Microsoft Entra and need to configure it so it can read user profile data from Microsoft Graph (using delegated permissions) and correctly handle responses at https://myapp.contoso.com/signin-oidc. Which two of the following steps must you perform in the app registration to ensure the application is properly set up?
- A
A. In the app registration's Manifest, set the signInAudience property to AzureADandPersonalMicrosoftAccount.
- B
B. Under the app registration's API permissions, add the Microsoft Graph delegated permission 'User.Read' and grant admin consent.
- C
C. In the Authentication blade, add 'https://myapp.contoso.com/signin-oidc' as the web redirect URI.
- D
D. In Certificates & secrets, create a client secret that never expires.
Show answer and explanation
Correct answers: B, C
Explanation
When creating an Entra app registration to enable OAuth 2.0 authorization code flow, you must configure valid redirect URIs so the application can properly handle sign-in responses. Additionally, you must grant the appropriate permissions for the application to read user data from Microsoft Graph. Refer to Microsoft documentation on creating an application with delegated permissions and adding redirect URIs in Azure AD (Microsoft Entra) for detailed guidance.
- A. Incorrect.
Option A: Incorrect. The signInAudience property determines who can sign in (e.g., only Azure AD users or also personal Microsoft accounts). While certain apps need a broader audience, there's no requirement in the scenario for allowing personal Microsoft accounts, so setting this to AzureADandPersonalMicrosoftAccount isn’t necessarily correct.
- B. Correct.
Option B: Correct. To call Microsoft Graph and read user profiles, you must add the 'User.Read' delegated permission under 'API permissions.' Granting admin consent ensures your application can access the requested user data on behalf of signed-in users.
- C. Correct.
Option C: Correct. In an OAuth 2.0 authorization code flow, you must specify valid redirect URIs. Adding 'https://myapp.contoso.com/signin-oidc' in the Authentication blade as a web redirect URI is essential for the authentication flow to complete successfully.
- D. Incorrect.
Option D: Incorrect. Microsoft now recommends setting client secrets with defined expiration periods (e.g., 6-24 months). Indefinitely expiring secrets are not available nor secure, and best practice is to rotate credentials regularly.