AZ-500 Question 31
Select 2You are building a Logic App that calls an internal web API registered in Azure Active Directory (Azure AD). You want to define a custom permission scope on the API that requires administrator consent before the Logic App can access sensitive operations on behalf of users. Which two steps must you perform to properly configure the custom permission scope and enable the Logic App to request it?
- A
Define the custom permission scope in the API’s app registration under the 'Expose an API' blade, specify 'Admin consent required,' and provide a meaningful user consent display name and description.
- B
In the API’s app registration under 'Expose an API,' directly assign the Logic App as an allowed client application without requiring consent from an administrator.
- C
Add the newly created scope to the Logic App’s app registration (or associated Enterprise Application) under 'API permissions' and request/admin-consent the permission from a global administrator.
- D
Create a role assignment at the Azure Resource Group level that maps the Logic App's Managed Identity to the custom scope in the API.
Show answer and explanation
Correct answers: A, C
Explanation
When configuring custom permission scopes for an Azure AD-registered API, you first define the scope in the API’s app registration under 'Expose an API' and mark whether admin consent is required. Then, the client (in this case, the Logic App) must explicitly request the permission under 'API permissions' in its own app registration or Enterprise Application. An administrator must grant consent if the scope requires admin approval. Refer to Microsoft’s documentation on 'Expose APIs and define scopes' for detailed guidance: https://learn.microsoft.com/azure/active-directory/develop/quickstart-configure-app-expose-apis.
- A. Correct.
Option 1 is correct because you must define the custom scope for the API through the 'Expose an API' section of the app registration. Setting 'Admin consent required' ensures an administrator must grant permission to requesting clients.
- B. Incorrect.
Option 2 is incorrect because merely adding the Logic App as an allowed client application does not bypass the need for administrator consent when 'Admin consent required' is set. You still need an admin-granted permission for delegated access.
- C. Correct.
Option 3 is correct because once the scope is defined, you must add and consent to it in the Logic App’s app registration (or its Enterprise Application, if it is using a managed identity). This step ensures Azure AD tokens contain the proper scope for delegated calls to the API.
- D. Incorrect.
Option 4 is incorrect because Azure Resource Manager role assignments do not control Azure AD app registration permission scopes. Scopes for custom APIs are managed in Azure AD, not through resource-level roles.