AZ-204 Implement Azure security Practice Question
You are developing a web app that authenticates users via Microsoft Entra ID. The app needs to access the Microsoft Graph API to read user profiles. Which type of permission should you request in the app registration to ensure the app can read profiles without user interaction?
⚠ Common exam trap
It's easy for candidates to confuse delegated permissions (which require a user) with application permissions (which do not), especially when the scenario mentions 'read user profiles' without explicitly stating the app runs as a background service or daemon.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Application permissions
Application permissions are required for daemon or service-type applications that need to access Microsoft Graph API without a signed-in user. Unlike delegated permissions, which operate on behalf of a user, application permissions allow the app to authenticate as itself using the client credentials OAuth 2.0 flow, enabling read of user profiles without any user interaction.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Delegated permissions
Why it's wrong here
Delegated permissions enable an application to act on behalf of a signed-in user, accessing resources with the permissions granted to both the application and the user. This model requires a user to be present to authenticate and consent, making it unsuitable for background services or daemon applications that operate without direct user interaction. The effective permissions are the intersection of what the user can do and what the application is allowed to do.
- ✗
Resource-based permissions
Why it's wrong here
Resource-based permissions are not a recognized or standard permission type within Microsoft Entra ID or for accessing Microsoft Graph. Microsoft Graph primarily utilizes two distinct permission models: delegated permissions, where an application acts on behalf of a user, and application permissions, where the application acts as its own identity. This term might be confused with resource-specific consent, which is a different concept related to granular permissions for specific resources like Teams channels, but it's not a general permission type.
- ✗
Consent permissions
Why it's wrong here
Consent permissions is an incorrect term as 'consent' refers to the process by which a user or administrator grants an application authorization to access protected resources on their behalf or as itself. It is not a distinct type of permission in Microsoft Entra ID, but rather the mechanism through which delegated or application permissions are approved. The actual permissions define what an application can do, while consent defines how those permissions are granted.
- ✓
Application permissions
Why this is correct
Application permissions allow an application to access data and perform actions as its own identity, without a signed-in user. This model is essential for background services, daemon applications, or web apps that need to operate autonomously, such as processing data nightly or integrating with other services. These permissions typically require administrator consent because the application acts with its own high-privilege identity, affecting all users within the tenant.
Go deeper
Related to this question
About these practice questions
One of 881 original AZ-204 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.