Microsoft SC-300 Bundle

The application still sends the old unregistered callback URI. The reported symptom instead has this cause: The permission was defined only as a delegated scope for interactive users. The corrective action is: Define an application role with allowedMemberTypes Application and assign/consent it to the client service principal.

The API's delegated scope was never exposed or requested by the calling application. The reported symptom instead has this cause: The permission was defined only as a delegated scope for interactive users. The corrective action is: Define an application role with allowedMemberTypes Application and assign/consent it to the client service principal.

The client requests Graph scopes when calling a separate first-party backend API. The reported symptom instead has this cause: The permission was defined only as a delegated scope for interactive users. The corrective action is: Define an application role with allowedMemberTypes Application and assign/consent it to the client service principal.

The sensitive Graph scope is inadvertently classified as low impact under unrestricted user consent. To satisfy task 1, use: Choose the appropriate multitenant organizational account audience for the application. For task 2, use: Add the approved certificate public key to the app registration and configure the server to authenticate using its private key.

The permission was defined only as a delegated scope for interactive users. To satisfy task 1, use: Choose the appropriate multitenant organizational account audience for the application. For task 2, use: Add the approved certificate public key to the app registration and configure the server to authenticate using its private key.

The client requests Graph scopes when calling a separate first-party backend API. To satisfy task 1, use: Choose the appropriate multitenant organizational account audience for the application. For task 2, use: Add the approved certificate public key to the app registration and configure the server to authenticate using its private key.

Even if requesting an access token for the custom backend API's app ID URI/scope succeeds, this does not prove the required identity-control outcome. The decisive check is: Users from an approved second Entra tenant sign in, while a consumer-only Microsoft account is outside the intended audience.

Even if adding the approved certificate public key to the app registration succeeds, this does not prove the required identity-control outcome. The decisive check is: Users from an approved second Entra tenant sign in, while a consumer-only Microsoft account is outside the intended audience.

Even if adding the minimum delegated Graph scope succeeds, this does not prove the required identity-control outcome. The decisive check is: Users from an approved second Entra tenant sign in, while a consumer-only Microsoft account is outside the intended audience.

The registration uses broad application permissions instead of the needed delegated user scope. The reported symptom instead has this cause: The supported account types setting remains single-tenant. The corrective action is: Choose the appropriate multitenant organizational account audience for the application.

The client requests Graph scopes when calling a separate first-party backend API. The reported symptom instead has this cause: The supported account types setting remains single-tenant. The corrective action is: Choose the appropriate multitenant organizational account audience for the application.

The sensitive Graph scope is inadvertently classified as low impact under unrestricted user consent. The reported symptom instead has this cause: The supported account types setting remains single-tenant. The corrective action is: Choose the appropriate multitenant organizational account audience for the application.

The app was registered as a confidential web client and relies on a browser-exposed secret. That condition is not the problem here: The client was configured to require confidential-client authentication despite being distributed as a public binary. The targeted implementation is: Register the correct public client platform and use an approved interactive flow with PKCE or broker support.

The sensitive Graph scope is inadvertently classified as low impact under unrestricted user consent. That condition is not the problem here: The client was configured to require confidential-client authentication despite being distributed as a public binary. The targeted implementation is: Register the correct public client platform and use an approved interactive flow with PKCE or broker support.

The client requests Graph scopes when calling a separate first-party backend API. That condition is not the problem here: The client was configured to require confidential-client authentication despite being distributed as a public binary. The targeted implementation is: Register the correct public client platform and use an approved interactive flow with PKCE or broker support.

Even if defining a delegated scope under Expose an API succeeds, this does not prove the required identity-control outcome. The decisive check is: The mobile app obtains delegated user tokens without shipping a secret in its application package.

Even if adding the approved certificate public key to the app registration succeeds, this does not prove the required identity-control outcome. The decisive check is: The mobile app obtains delegated user tokens without shipping a secret in its application package.

Even if registering the browser app as an SPA with exact redirect URIs succeeds, this does not prove the required identity-control outcome. The decisive check is: The mobile app obtains delegated user tokens without shipping a secret in its application package.

The app registration has only the old client secret and no matching certificate credential. The reported symptom instead has this cause: The client was configured to require confidential-client authentication despite being distributed as a public binary. The corrective action is: Register the correct public client platform and use an approved interactive flow with PKCE or broker support.

The client requests Graph scopes when calling a separate first-party backend API. The reported symptom instead has this cause: The client was configured to require confidential-client authentication despite being distributed as a public binary. The corrective action is: Register the correct public client platform and use an approved interactive flow with PKCE or broker support.

The sensitive Graph scope is inadvertently classified as low impact under unrestricted user consent. The reported symptom instead has this cause: The client was configured to require confidential-client authentication despite being distributed as a public binary. The corrective action is: Register the correct public client platform and use an approved interactive flow with PKCE or broker support.

The client requests Graph scopes when calling a separate first-party backend API. That condition is not the problem here: The API validates only token signature and ignores resource-specific role authorization. The targeted implementation is: Define and enforce an API application role and validate the app-only token's roles claim at the resource.

The permission was defined only as a delegated scope for interactive users. That condition is not the problem here: The API validates only token signature and ignores resource-specific role authorization. The targeted implementation is: Define and enforce an API application role and validate the app-only token's roles claim at the resource.

The sensitive Graph scope is inadvertently classified as low impact under unrestricted user consent. That condition is not the problem here: The API validates only token signature and ignores resource-specific role authorization. The targeted implementation is: Define and enforce an API application role and validate the app-only token's roles claim at the resource.

Even if tracking application credential expiry succeeds, this does not prove the required identity-control outcome. The decisive check is: A token without the required role is denied while an assigned service principal can call the restricted endpoint.

Even if defining an application role with allowedMemberTypes Application succeeds, this does not prove the required identity-control outcome. The decisive check is: A token without the required role is denied while an assigned service principal can call the restricted endpoint.

Even if defining a delegated scope under Expose an API succeeds, this does not prove the required identity-control outcome. The decisive check is: A token without the required role is denied while an assigned service principal can call the restricted endpoint.

The API's delegated scope was never exposed or requested by the calling application. The reported symptom instead has this cause: The API validates only token signature and ignores resource-specific role authorization. The corrective action is: Define and enforce an API application role and validate the app-only token's roles claim at the resource.

The client requests Graph scopes when calling a separate first-party backend API. The reported symptom instead has this cause: The API validates only token signature and ignores resource-specific role authorization. The corrective action is: Define and enforce an API application role and validate the app-only token's roles claim at the resource.

The supported account types setting remains single-tenant. The reported symptom instead has this cause: The API validates only token signature and ignores resource-specific role authorization. The corrective action is: Define and enforce an API application role and validate the app-only token's roles claim at the resource.

The client was configured to require confidential-client authentication despite being distributed as a public binary. That condition is not the problem here: The app registration has only the old client secret and no matching certificate credential. The targeted implementation is: Add the approved certificate public key to the app registration and configure the server to authenticate using its private key.

The sensitive Graph scope is inadvertently classified as low impact under unrestricted user consent. That condition is not the problem here: The app registration has only the old client secret and no matching certificate credential. The targeted implementation is: Add the approved certificate public key to the app registration and configure the server to authenticate using its private key.

Owners assume the app registration automatically renews uploaded certificate credentials. That condition is not the problem here: The app registration has only the old client secret and no matching certificate credential. The targeted implementation is: Add the approved certificate public key to the app registration and configure the server to authenticate using its private key.