AZ-500 Question 32
Single answerYour organization has created a custom REST API that must be secured using Azure Active Directory, allowing external applications to request specific permission scopes. After registering the API as an app in Azure Active Directory, which step is required to properly configure the custom permission scopes so they can be requested and consented to by external client applications?
- A
Define and assign the custom permission scopes in the client application’s “API Permissions” blade, then mark them as User.Read permissions.
- B
Create the custom permission scopes under the “Expose an API” section of the API’s own app registration and configure consent properties appropriately.
- C
Enable the built-in Microsoft Graph delegated permissions from the client application and reference them in the API’s app registration.
- D
Add an app role in Azure Active Directory under “App roles,” and require administrators to grant these roles to external client users.
Show answer and explanation
Correct answer: B
Explanation
When creating a custom API secured by Azure AD, you must expose permission scopes in the API’s own app registration. Under the “Expose an API” section, you define each scope’s name and consent properties. Client applications then refer to these scopes under their own API Permissions. Administrators or users can grant consent for these scopes depending on how you configure the consent settings. For more details, see the official Microsoft Azure documentation on configuring custom API permissions (https://learn.microsoft.com/azure/active-directory/develop/quickstart-configure-app-expose-web-apis).
- A. Incorrect.
Incorrect. Custom permission scopes must be defined in the API’s app registration, not in the client app’s API Permissions blade. Defining them in the client app directly will not make them available for other external apps.
- B. Correct.
Correct. Defining custom permission scopes under “Expose an API” in the API’s app registration is the standard method. You must specify display name, scope name, and consent settings so external clients can request and gain consent for those scopes.
- C. Incorrect.
Incorrect. Built-in Microsoft Graph permissions only apply to the Microsoft Graph API, not custom APIs your organization creates. You need to create and expose your own custom scopes for your API.
- D. Incorrect.
Incorrect. App roles differ from permission scopes. While you can use app roles for user or group assignments, they do not directly enable external client applications to request delegated permissions for your custom API.