PRACTICE / MODULE 012 / MICROSOFT ENTRA

It signed in.
Can it read the data?

Build and test application permissions, consent and managed identity access in a fictional Northstar environment, alongside original flashcards, questions and guided incidents.

← Review the Learn guide Open Authorization Builder ↓SC-300 objective map →

03 / APPLY THE DECISIONS

Work the application-access ticket.

Two original, fictional Northstar Services incidents. Choose the next action, inspect the reasoning, and proceed only when the evidence supports it. Unsafe shortcuts won't close the ticket.

NORTHSTAR SERVICES / TICKET HR-SAASMODERATE PRIORITY

HR SaaS onboarding

Northstar is replacing a legacy HR portal with a cloud SaaS tool. HR must receive SSO and account lifecycle management; non-HR users should not gain access.

STEP 1 OF 4

The vendor is already in the Entra gallery. Where do you start?

NORTHSTAR / SC-300 / IDENTITY APPLICATION OPERATIONS

Application Authorization & Consent Builder

Change a fictional tenant configuration, issue modeled access tests, inspect why each operation succeeds or fails, and prove least privilege before closing the ticket. This is interactive simulated administration—not a connected Microsoft tenant.

0 of 3 investigations verified · State resets on page reload · Original Practice 012 progress is preserved

TICKET APP-204 / AUTHORIZATION INVESTIGATION

Expense Portal: a signed-in user can't read an expense report

Alex in Finance needs read access to Expense Portal. Jamie in Marketing must remain unassigned. Alex must not be able to change an expense. Repair the delegated client permission, tenant grant and enterprise-app assignment without broadening access.

OPEN0 / 3 outcomes matched

01 / CONFIGURE

Build the access model

Each change invalidates prior test results. Review your token flow, permission type, consent and resource scope before running the checks.

Token flow

Requested Expense API scope

Permission grant

Enterprise app: user assignment requiredEnabled

Alex is assigned to the appDisabled

Jamie is assigned to the appDisabled

What is being authorized?

For a signed-in user, model delegated API scopes, tenant consent, enterprise app assignment and the requested operation separately. Admin consent does not override an assignment-required application's user restriction.

02 / VERIFY

Run permission tests

Run all three operations, including deliberate denied cases. A successful sign-in or token acquisition alone never proves the resource operation is authorized.

EXPECTED: PERMITTEDAlex reads Expense Portal records

Not tested. Changes must be verified against this exact identity and operation.

EXPECTED: DENIEDJamie (unassigned) reads expense records

Not tested. Changes must be verified against this exact identity and operation.

EXPECTED: DENIEDAlex modifies expense records

Not tested. Changes must be verified against this exact identity and operation.

Verification incomplete.0 / 3 intended outcomes demonstrated

03 / DOCUMENT

Leave useful ticket evidence

The simulated change trail and validation notes are available for review. No user data or credentials are transmitted or saved outside this session.

Microsoft referenceDelegated versus application permissions ↗Application admin consent ↗Managed identities & Azure access ↗

LEARN → PRACTICE → LAB → TROUBLESHOOT

Know the principal. Check the grant. Validate the resource.

Revisit the standalone guide or explore the SC-300 map for additional application and governance objectives.

Review the Learn guide →