AZ-500 Question 33
Select 3You are developing a multi-tenant web API for your organization. You need to define custom permission scopes so that client applications in other Azure Active Directory tenants can request delegated access to your API. After creating the initial app registration for your API in your own tenant, which of the following steps must you perform to properly configure these custom scopes and allow external tenant admins to grant them? (Choose three.)
- A
In the 'Expose an API' section of the app registration, create one or more custom permission scopes and specify whether those scopes require user or admin consent.
- B
In the client app registration requesting the scope, add the newly created scope under 'API Permissions' and mark it as a delegated permission.
- C
Enable the OAuth 2.0 implicit grant flow to bypass the need for admin consent on your newly defined permission scopes.
- D
Grant admin consent for the created scopes in your tenant, then instruct external tenant administrators to grant admin consent in their own tenants.
Show answer and explanation
Correct answers: A, B, D
Explanation
When configuring custom permission scopes for a multi-tenant environment, you must define the scopes under the 'Expose an API' section in your web API's app registration, then ensure client applications add those scopes in their 'API Permissions.' If any scope requires admin consent, the administrator in each tenant (including yours and any external ones) must explicitly grant that consent. For more details, refer to Microsoft documentation on creating and using custom scopes for a protected web API: https://learn.microsoft.com/azure/active-directory/develop/scenario-protected-web-api-app-registration.
- A. Correct.
Option 1 is correct. When you expose your web API through Azure AD, you must define custom permission scopes in the 'Expose an API' blade of your app registration. You can choose whether the scope requires admin consent or can be consented to by end users. This step is mandatory so that other applications can request these permissions.
- B. Correct.
Option 2 is correct. A client application must explicitly request the custom scopes by adding them to its 'API Permissions' list. Marking a scope as delegated indicates the client app will be requesting permissions on behalf of a signed-in user. Without adding the scope under 'API Permissions,' the client cannot request tokens with that scope.
- C. Incorrect.
Option 3 is incorrect. Enabling the OAuth 2.0 implicit flow does not remove the need to have the proper consent granted, especially for permissions that require admin consent. Implicit flow is mainly about how tokens are returned to client-side applications, not about bypassing the consent process.
- D. Correct.
Option 4 is correct. In a multi-tenant scenario, you must first grant admin consent to the defined scopes in your own directory. Then, external tenant admins also need to explicitly grant consent for those scopes within their directories. This ensures proper authorization and compliance with consent requirements in each tenant.