Question
You have a Microsoft Entra tenant that has the following configurations:
User consent for applications is disabled.
Only administrators can grant permissions to applications.
You register an application named App1 that uses delegated Microsoft Graph permissions.
You need to configure App1 to meet the following requirements:
Enable user sign-ins without interactive consent prompts.
Enable App1 to access Microsoft Graph on behalf of the signed-in user.
What should you do?
- A. Configure enterprise applications to require user assignment and assign users to App1.
- B. Modify the app registration to use application permissions instead of delegated permissions.
- C. Add the required delegated Microsoft Graph permissions to the app registration and rely on user consent during sign-in.
- D. Grant admin consent to App1 for the required delegated permissions. Correct
Explanation
Tenant-wide admin consent grants the delegated permissions on behalf of all users, so users sign in without a consent prompt and App1 calls Microsoft Graph as the signed-in user. Requiring user assignment only controls who can sign in and grants no permissions. Application permissions let an app run without a signed-in user, which fails the on-behalf-of requirement. Relying on user consent cannot work because user consent is disabled in this tenant.
