An organization uses a custom enterprise application that requires the 'User.Read' delegated permission. The application is assigned to all employees. The security team wants to ensure that users cannot grant additional permissions to the application. What should they configure?

Create a conditional access policy that blocks the application for non-compliant devices.

Disable user consent for the application and grant admin consent for the required permission.

Set the application to require user assignment.

Remove the User.Read permission from the app registration.

What is a service principal in Microsoft Entra ID?

A user account that is used for administrative tasks

The local representation of an application in a specific tenant

A group of users with similar access needs

A company is deploying a background job that runs on an Azure VM and needs to read blobs from a storage account. The security team requires that no credentials be stored in the VM or in the application code. The job will run continuously and must not require manual intervention when the VM is restarted. What should you do to authenticate the job to the storage account?

Store the storage account access key in the VM's custom data and have the job read it from there.

Create a service principal, store its client secret in Azure Key Vault, and have the job retrieve the secret at startup.

Create a user-assigned managed identity, assign it to the VM, and grant it the Storage Account Contributor role.

Assign a system-assigned managed identity to the VM and grant that identity the Storage Blob Data Reader role on the storage account.

A developer created an app registration for a web app. The app needs to authenticate users and call Microsoft Graph. The developer accidentally exposed a permission scope that is too broad. What should the developer do to fix this?

Disable the app registration and create a service principal.

Change the app registration to be multi-tenant.

Edit the app registration to remove the broad scope and add a narrower scope, then update the client app to request the new scope.

Delete the app registration and create a new one with the correct scopes.

Microsoft Certified:Azure Security Engineer Associate

Domain 1Objective 2

Manage Microsoft Entra Application Access and Managed Identities AZ-500 Practice Questions (Page 4)

Part of the Secure identity and access domain, which accounts for 15–20% of the AZ-500 exam. Microsoft does not publish an official question count, but from its 100-minute exam (~40–65 total, ~6–13 in this domain), expect 3–7 from this objective — we provide 36 practice questions to prepare you well beyond it. (estimate)

36questions here

8free pages

6concepts

15–20%of the exam

Questions 16–20

16foundation · easy
Which type of permission in Microsoft Entra ID allows an application to access an API without a signed-in user, such as a background service or daemon?
Select an answer first
17application · medium
An organization uses a custom enterprise application that requires the 'User.Read' delegated permission. The application is assigned to all employees. The security team wants to ensure that users cannot grant additional permissions to the application. What should they configure?
Select an answer first
18foundation · easy
What is a service principal in Microsoft Entra ID?
Select an answer first
19application · medium
A company is deploying a background job that runs on an Azure VM and needs to read blobs from a storage account. The security team requires that no credentials be stored in the VM or in the application code. The job will run continuously and must not require manual intervention when the VM is restarted. What should you do to authenticate the job to the storage account?
Select an answer first
20expert · medium
A developer created an app registration for a web app. The app needs to authenticate users and call Microsoft Graph. The developer accidentally exposed a permission scope that is too broad. What should the developer do to fix this?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to AZ-500

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Microsoft. “AZ-500” is a trademark of its owner, used for identification only.

Manage Microsoft Entra Application Access and Managed Identities AZ-500 Practice Questions (Page 4)

Questions 16–20

Which type of permission in Microsoft Entra ID allows an application to access an API without a signed-in user, such as a background service or daemon?

An organization uses a custom enterprise application that requires the 'User.Read' delegated permission. The application is assigned to all employees. The security team wants to ensure that users cannot grant additional permissions to the application. What should they configure?

What is a service principal in Microsoft Entra ID?

A developer created an app registration for a web app. The app needs to authenticate users and call Microsoft Graph. The developer accidentally exposed a permission scope that is too broad. What should the developer do to fix this?

Keep studying — Secure identity and access