A company is using a third-party application that requires the 'User.Read.All' delegated permission. The security team wants to allow the app to be used by the HR department only, and they want to prevent any user from consenting to the permission. What should they do?

Create a conditional access policy that requires HR users to be in a specific group.

Assign the HR department to the enterprise application and grant admin consent for User.Read.All.

Block the application and create a custom app with limited permissions.

Disable user consent for the application and allow HR users to request admin consent.

A developer is creating an app registration for a web API that will be consumed by multiple client applications. The API needs to expose a permission that allows clients to read data on behalf of the signed-in user. What should the developer configure in the app registration?

Add a client secret to the API's app registration and share it with client applications.

Define an application role named 'Data.Read' and set its 'Allowed member types' to 'Users/Groups'.

Set the API's 'Supported account types' to 'Accounts in this organizational directory only'.

Define an OAuth2 permission scope named 'Data.Read' and set its 'Who can consent' to 'Admins and users'.

Microsoft Certified:Azure Security Engineer Associate

Domain 1Objective 2

Manage Microsoft Entra Application Access and Managed Identities AZ-500 Practice Questions (Page 1)

Part of the Secure identity and access domain, which accounts for 15–20% of the AZ-500 exam. Microsoft does not publish an official question count, but from its 100-minute exam (~40–65 total, ~6–13 in this domain), expect 3–7 from this objective — we provide 36 practice questions to prepare you well beyond it. (estimate)

36questions here

8free pages

6concepts

15–20%of the exam

Questions 1–5

1foundation · easy
A developer wants to register a new application in Microsoft Entra ID so it can authenticate users and call Microsoft Graph. Which portal blade should the developer use to create the app registration?
Select an answer first
2foundation · easy
An administrator needs to allow a third-party enterprise application to access Microsoft Graph on behalf of users in the organization. Which Microsoft Entra ID feature must be configured to grant this access?
Select an answer first
3expert · medium
A company is using a third-party application that requires the 'User.Read.All' delegated permission. The security team wants to allow the app to be used by the HR department only, and they want to prevent any user from consenting to the permission. What should they do?
Select an answer first
4foundation · easy
Which of the following is a required property when creating a new app registration in Microsoft Entra ID?
Select an answer first
5application · medium
A developer is creating an app registration for a web API that will be consumed by multiple client applications. The API needs to expose a permission that allows clients to read data on behalf of the signed-in user. What should the developer configure in the app registration?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to AZ-500

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Microsoft. “AZ-500” is a trademark of its owner, used for identification only.

Manage Microsoft Entra Application Access and Managed Identities AZ-500 Practice Questions (Page 1)

Questions 1–5

A developer wants to register a new application in Microsoft Entra ID so it can authenticate users and call Microsoft Graph. Which portal blade should the developer use to create the app registration?

An administrator needs to allow a third-party enterprise application to access Microsoft Graph on behalf of users in the organization. Which Microsoft Entra ID feature must be configured to grant this access?

A company is using a third-party application that requires the 'User.Read.All' delegated permission. The security team wants to allow the app to be used by the HR department only, and they want to prevent any user from consenting to the permission. What should they do?

Which of the following is a required property when creating a new app registration in Microsoft Entra ID?

A developer is creating an app registration for a web API that will be consumed by multiple client applications. The API needs to expose a permission that allows clients to read data on behalf of the signed-in user. What should the developer configure in the app registration?

Keep studying — Secure identity and access