AZ-500 Question 36
Select 2You manage an Azure AD tenant that hosts a custom application needing delegated permissions to read user profiles from Microsoft Graph and also requires offline_access. Your security policy mandates that only administrators can provide consent for these permissions, but users should still be able to sign in to the application with Azure AD credentials. Which two actions should you take to meet these requirements?
- A
- In the Azure AD tenant’s Enterprise applications → User settings, set “Users can consent to apps accessing company data on their behalf” to No.
- B
- In the app registration’s API Permissions blade, select “Grant admin consent” for the required delegated permissions.
- C
- Modify the default sign-in audience of the application from Single tenant to Multi-tenant in the app registration.
- D
- In the app registration’s Authentication settings, clear the “Access tokens” checkbox under Implicit grant and hybrid flows.
Show answer and explanation
Correct answers: A, B
Explanation
To restrict permission consent to administrators, you must disable standard user consent at the tenant level and then grant the necessary delegated permissions through an admin consent process. This approach ensures end users can still sign in (using their Azure AD credentials) but cannot individually grant high-privilege permissions. Refer to the official Microsoft documentation (https://learn.microsoft.com/azure/active-directory/manage-apps/configure-user-consent) for steps on modifying user consent settings and granting admin consent in Azure AD.
- A. Correct.
Correct. Disabling user consent in the tenant forces approval by an administrator for any delegated permissions that require consent. This prevents end users from individually granting consent to sensitive permissions.
- B. Correct.
Correct. Administrators must explicitly grant consent for the delegated permissions. By clicking the “Grant admin consent” button for the application, you ensure that only an admin can authorize the permissions requested on behalf of all users.
- C. Incorrect.
Incorrect. Changing the sign-in audience to Multi-tenant does not control whether users can consent. It only affects who in other Azure AD tenants can sign in to the application. This does not address the need to limit approval to admins.
- D. Incorrect.
Incorrect. Clearing “Access tokens” in the Implicit grant settings does not regulate consent. This setting controls token issuance in certain OAuth2/OIDC flows but does not manage who can grant permissions.