SC-900 Describe the capabilities of Microsoft Entra Practice Question
Your company, Proseware, uses Microsoft Entra ID P2. You have a custom application that integrates with Microsoft Graph API to read user profiles. The application uses client credentials flow (application permissions). You need to ensure that the application can only read user profiles and not perform any other operations. Additionally, you want to review and approve the permissions periodically. What should you do?
⚠ Common exam trap
Watch out — candidates often confuse Conditional Access policies or PIM with permission management, not realizing that application permissions in the client credentials flow are static and require access reviews for periodic oversight, not dynamic runtime controls.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
In Microsoft Entra ID, grant the application the User.Read.All permission and configure an access review for the application permissions.
The application uses client credentials flow (application permissions), which requires granting an application permission like User.Read.All to read all user profiles. Configuring an access review for the application permissions in Microsoft Entra ID allows periodic review and approval of those permissions, meeting the requirement to ensure the app can only read user profiles and that permissions are reviewed periodically.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Create a Conditional Access policy to restrict the app to read-only operations.
Why it's wrong here
Conditional Access policies are designed to enforce conditions on *who* can access resources and *how* they can access them (e.g., requiring MFA, compliant device, or specific network location), but they do not control the granular scope of permissions an application has already been granted. An application's read/write capabilities are determined by the specific API permissions consented to in Microsoft Entra ID, not by Conditional Access policies, which operate at a higher level of access control.
- ✗
Enable Privileged Identity Management for the app and require approval for each API call.
Why it's wrong here
Microsoft Entra Privileged Identity Management (PIM) is primarily used to manage, control, and monitor access to important resources by providing just-in-time and time-bound access to administrative roles or group memberships. PIM does not offer the capability to require approval for each individual API call made by an application, nor does it directly manage the granular scope of application permissions. Its focus is on role activation and privilege elevation, not real-time API operation authorization.
- ✗
Use delegated permissions for the application and assign users to the app role.
Why it's wrong here
Delegated permissions are utilized when an application acts on behalf of a signed-in user, requiring both the application's and the user's permissions to be considered. For applications operating independently, such as background services or daemons using the client credentials flow, *application permissions* are required. Assigning users to an app role controls user access to the application itself or specific features, but it does not enable an application to access data without a user context when application permissions are needed.
- ✓
In Microsoft Entra ID, grant the application the User.Read.All permission and configure an access review for the application permissions.
Why this is correct
Granting the `User.Read.All` application permission provides the necessary access for an application to read all user profiles in Microsoft Entra ID without granting excessive write or administrative capabilities, adhering to the principle of least privilege. Configuring an access review for these application permissions ensures that the granted access is periodically re-evaluated by designated reviewers, promoting ongoing security hygiene and preventing the accumulation of stale or unnecessary permissions over time.
Go deeper
Related to this question
Learn chapter
Microsoft Entra ID
Key term
Microsoft Entra ID
Microsoft Entra ID is a cloud-based identity and access management service that lets employees sign in and access resources both inside and outside of your organization.
Key term
User
A user is any person, system, or device that interacts with an IT service, resource, or identity system, typically authenticated through credentials and authorized to perform specific actions.
About these practice questions
This SC-900 question is part of Courseiva's 1,250-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.