Implement and manage Microsoft Entra identity and access →mediumMultiple Choice

MS-102 Practice Question: Implement and manage Microsoft Entra identity and access

Exhibit

Refer to the exhibit.

{
  "apps": [
    {
      "appId": "00000003-0000-0000-c000-000000000000",
      "displayName": "Microsoft Graph",
      "permissions": [
        {
          "name": "User.Read.All",
          "adminConsentRequired": true,
          "userConsentPossible": false
        },
        {
          "name": "Mail.Read",
          "adminConsentRequired": false,
          "userConsentPossible": true
        }
      ]
    }
  ]
}

Refer to the exhibit. You are configuring consent for the Microsoft Graph application. Which of the following statements is true based on the JSON?

⚠ Common exam trap

Many exam-takers assume all permissions with 'Read' in the name are user-consentable, but Microsoft marks permissions that access data across the entire organization (like User.Read.All) as requiring admin consent, while user-scoped reads (like Mail.Read) may not.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The User.Read.All permission requires admin consent.

The JSON shows the User.Read.All permission has the 'AdminConsentRequired' property set to true, meaning it requires admin consent. The Mail.Read permission has 'AdminConsentRequired' set to false, so users can consent to it without admin involvement. Option D correctly identifies that User.Read.All requires admin consent.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Users can consent to the User.Read.All permission.
Why it's wrong here
The statement is incorrect because User.Read.All is a delegated permission that reads every user's full profile across the tenant, not just the signed-in user's. In the JSON, User.Read.All has both adminConsentRequired set to true and userConsentPossible set to false, meaning it is explicitly flagged as needing administrator approval. Standard users cannot grant this permission themselves, regardless of consent prompts or end-user acceptance.
✗
The Mail.Read permission requires admin consent.
Why it's wrong here
This claim is false because Mail.Read appears in the JSON with adminConsentRequired: false, indicating it does not need administrator consent. Mail.Read is a delegated permission that allows a signed-in user to read their own mailbox, and Microsoft has classified it as a user-consentable permission. Therefore, an ordinary user can consent to it during the standard OAuth consent flow without any admin involvement.
✗
No consent is required for either permission.
Why it's wrong here
The premise that no consent is needed is wrong because both permissions require consent, albeit from different parties. Mail.Read is a user-consentable permission that requires the signed-in user to grant access, whereas User.Read.All requires a tenant administrator to provide admin consent. The JSON explicitly flags that consent is needed for both, just at different levels, so the statement is contradicted by the permission metadata.
✓
The User.Read.All permission requires admin consent.
Why this is correct
This is correct because the JSON entry for User.Read.All shows adminConsentRequired: true and userConsentPossible: false. User.Read.All grants access to every user's full profile across the organization, a high-privilege scope that Microsoft mandates be approved by an administrator to prevent lateral data exposure. A regular user cannot see an admin consent prompt or grant this permission, so tenant-wide admin consent is mandatory.

Go deeper

MS-102 Practice Question: Implement and manage Microsoft Entra identity and access

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question