Microsoft Certified: Azure Solutions Architect Expert Practice Mode

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• 2

  Given answers are correct. Authentication: Application registration in Azure AD: This allows you to register the applications in Azure AD, enabling user authentication via their Azure AD credentials. Authorization: Delegated permissions: These permissions allow the applications to act on behalf of the signed-in user, granting the necessary read and write access to the user's calendar while adhering to the principle of least privilege.

• 2

  Why Not Other Options? Authentication: System-assigned managed identity: Suitable for accessing Azure resources without credentials, but not for user authentication to an app that requires user-specific permissions. User-assigned managed identity: Similar to system-assigned but managed separately. Not ideal for user-specific access, which requires handling user tokens. Authorization: Application permissions: Grants the application itself broad access, which violates the principle of least privilege as it would give more permissions than needed. Azure role-based access control (Azure RBAC): Best for managing resource access within Azure, but not for specific application-level permissions for user data like calendar access.

• 2

  You have two applications (App1 and App2) on 100 VMs. App1 needs to read and App2 needs to write to a resource for a "logged in user". Access must be to applications, not VMs, following the principle of least privilege. Logged-in User Identity: Using "user-assigned managed identity" is not appropriate as applications use the logged-in user's identity, requiring delegated permissions. Using Azure RBAC: RBAC assigns permissions directly to applications, but because they need to act on the user's behalf, you must use delegated permissions. Correct Solution: - Application registration in Azure AD - Delegated permissions