Continue your lesson
Trace the identity, credential, token, assignment, policy decision, resource, and audit record for each access request.
Block 1 of 3Compare App registration · API permission
Current · 12 min
Compare App registration · API permission
Optional concept notes
App registration
Defines an application's Microsoft identity platform configuration and application object.
API permission
Declares delegated or application access that a client requests for a protected API.
Complete one provider lesson, then answer four related questions. That is enough for today; more practice is optional.
Your lesson stays open here while the provider opens in another tab. Choose one source; the notes above are optional.
Block 2 of 3Compare Redirect URI · Expose an API · Application manifest
15 min
Compare Redirect URI · Expose an API · Application manifest
Optional concept notes
Redirect URI
Specifies an allowed location where the identity platform may return an authorization response.
Expose an API
Defines scopes or application roles that other clients can request from an application.
Application manifest
Provides the JSON representation of many app-registration settings for direct editing.
Complete one provider lesson, then answer four related questions. That is enough for today; more practice is optional.
Your lesson stays open here while the provider opens in another tab. Choose one source; the notes above are optional.
Block 3 of 3Compare Tenant-wide admin consent · Application role · Optional claim
18 min
Compare Tenant-wide admin consent · Application role · Optional claim
Optional concept notes
Tenant-wide admin consent
Approves requested permissions for the organization when administrator approval is required.
Application role
Defines an assignable role that appears in tokens for users groups or applications.
Optional claim
Adds a supported extra claim to tokens issued for an application.
Complete one provider lesson, then answer four related questions. That is enough for today; more practice is optional.
Your lesson stays open here while the provider opens in another tab. Choose one source; the notes above are optional.
Practice the reasoning here
Use a fictional tenant. Draw one access path, apply least privilege, test an exception, and name the logs that would confirm the result.
- State the expected result before changing or testing anything.
- Name the observation, command, log, or report that would confirm it.
- Explain why the closest alternative does not fit the same requirement.
Check the whole objective
This unlocks objective 3.3 for recall. The latest checkpoint needs 70% or higher; a lower result puts the lesson back near the front of your timeline.