Contoso has a custom line-of-business app registered in Microsoft Entra ID. The app needs to read all users' profiles and send email as the signed-in user. The app is used by 500 employees. The security team wants to minimize the number of consent prompts while ensuring that only approved permissions are granted. What should you configure?

Create a new app registration for each department and assign different permissions.

Grant admin consent for the required permissions and configure the app to require user assignment.

Enable the user consent setting for all users and let each user consent individually.

Use the delegated permission User.Read and Mail.Send, and set the app to be multi-tenant.

A developer has created an app registration in Microsoft Entra ID for a new web API. The API will be called by a daemon application that runs unattended. The daemon needs to authenticate without a user. What should the developer configure in the app registration to support this?

Set the API's application to be multi-tenant so the daemon can access it.

Add a client secret to the API's app registration and have the daemon use it directly.

Expose a delegated permission (OAuth2 permission scope) and configure the daemon to use the authorization code flow.

Expose an application permission (app role) and configure the daemon's app registration to request that permission.

A company has a custom enterprise application that is assigned to all users. The application requests the 'Mail.Read' delegated permission. The security team wants to ensure that only the marketing team can use the app and that no user can consent to additional permissions. What should they do?

Remove the Mail.Read permission from the app registration.

Create a conditional access policy that blocks all users except marketing.

Disable user consent for the app and keep the assignment to all users.

Change the app to require user assignment, assign only the marketing team, and grant admin consent for Mail.Read.

Which of the following is a common use case for a service principal?

Storing user passwords securely

Allowing a web app to authenticate to Azure SQL Database using its own identity

Providing a user with single sign-on to multiple applications

Managing user group memberships

A company has a custom enterprise application that requires the 'User.Read.All' application permission. The security team is concerned about the broad access. They want to allow the app to function but limit the data it can read. What should they do?

Ask the vendor to change the app to use a delegated permission with a narrower scope.

Use application roles and assign the app to a custom role that has limited permissions.

Block the application and create a custom proxy that limits data access.

Grant admin consent for User.Read.All and rely on the app to filter data.

Microsoft Certified:Azure Security Engineer Associate

Domain 1Objective 2

Manage Microsoft Entra Application Access and Managed Identities AZ-500 Practice Questions (Page 7)

Part of the Secure identity and access domain, which accounts for 15–20% of the AZ-500 exam. Microsoft does not publish an official question count, but from its 100-minute exam (~40–65 total, ~6–13 in this domain), expect 3–7 from this objective — we provide 36 practice questions to prepare you well beyond it. (estimate)

36questions here

8free pages

6concepts

15–20%of the exam

Questions 31–35

31application · medium
Contoso has a custom line-of-business app registered in Microsoft Entra ID. The app needs to read all users' profiles and send email as the signed-in user. The app is used by 500 employees. The security team wants to minimize the number of consent prompts while ensuring that only approved permissions are granted. What should you configure?
Select an answer first
32application · medium
A developer has created an app registration in Microsoft Entra ID for a new web API. The API will be called by a daemon application that runs unattended. The daemon needs to authenticate without a user. What should the developer configure in the app registration to support this?
Select an answer first
33expert · medium
A company has a custom enterprise application that is assigned to all users. The application requests the 'Mail.Read' delegated permission. The security team wants to ensure that only the marketing team can use the app and that no user can consent to additional permissions. What should they do?
Select an answer first
34foundation · easy
Which of the following is a common use case for a service principal?
Select an answer first
35expert · medium
A company has a custom enterprise application that requires the 'User.Read.All' application permission. The security team is concerned about the broad access. They want to allow the app to function but limit the data it can read. What should they do?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to AZ-500

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Microsoft. “AZ-500” is a trademark of its owner, used for identification only.