Skip to content

README.md

Latest commit

 

History

History
254 lines (172 loc) · 10.4 KB

README.md

File metadata and controls

254 lines (172 loc) · 10.4 KB

Lab 14 — Microsoft Graph PowerShell Command Chains (SC-300)

Lab 14 — Command-Chain Reasoning for Microsoft Entra ID (SC-300)

Purpose of This Lab

This lab is not about memorizing commands.

This lab trains you to:

  • Read a business / security scenario
  • Identify which identity objects must exist
  • Determine what relationships are missing
  • Select the correct sequence of command-line actions to establish those relationships

This directly mirrors how SC-300 questions are written.

The exam does NOT say:

“An application is missing permissions.”

Instead, it describes:

  • a workload
  • a security requirement
  • an access failure

You must infer what is missing.

Identity Objects In Scope

This lab works with four identity objects that SC-300 constantly blends together:

  1. Tenant (Directory)

    • Security boundary
    • Hosts all identity objects
    • Never “configured” directly in command chains

  2. Application Object (App Registration)

    • Global definition of an app
    • Defines:
      • requested permissions
      • app roles
      • supported OAuth flows
    • Does NOT grant access

  3. Service Principal (Enterprise Application)

    • Tenant-local instance of the app
    • Receives:
      • permission grants
      • consent
      • assignments
    • This is what actually runs in your tenant

  4. Resource API (e.g., Microsoft Graph)

    • Owns permission definitions (User.Read, Directory.Read.All, etc.)
    • Your tenant cannot modify these permissions
    • Apps can only request them

Critical Exam Rule

Permissions live on the RESOURCE, not on the app.

  • Microsoft Graph defines User.Read
  • Your app only REQUESTS User.Read
  • Your tenant GRANTS User.Read to the service principal

Scenario 1 — Delegated Access Failure

Business Scenario

A custom application needs to:

  • allow users to sign in
  • read the signed-in user’s profile from Microsoft Graph

Users report:

  • sign-in succeeds
  • Graph calls fail with authorization errors

Step 1 — Identify What Exists

From the scenario:

  • Application exists
  • Service principal exists
  • No permission grant exists

Step 2 — Identify the Missing Relationship

Missing:

  • Delegated permission request on the application object
  • Consent grant on the service principal

Step 3 — Correct Command-Chain Logic (Exam Thinking)

You must: A. Modify the application object to request User.Read from Microsoft Graph
B. Grant consent on the service principal

Step 4 — Conceptual Command Chain (Exam Style)

  1. Locate the application
  2. Add delegated permission request (User.Read)
  3. Grant admin consent

Order matters.

Why Order Matters

If you attempt to grant consent:

  • before the permission is requested
  • the command fails

SC-300 tests this sequencing heavily.

Delegated vs Application Permissions (Exam Critical)

Delegated Permissions

  • Require a signed-in user
  • Act as the user
  • Example: User.Read

Application Permissions

  • No user
  • App acts as itself
  • Requires explicit admin consent
  • Example: Directory.Read.All

Assignment vs Consent (Common Exam Trap)

Concept What It Controls
Assignment Who can sign in
Consent What the app can do

They are independent.

Key Exam Takeaways

  • Application object = definition
  • Service principal = execution
  • Resource API = permission authority
  • Requests ≠ grants
  • Consent is always applied to the service principal
  • Command order matters more than command syntax

End of Lab 14

Lab 14 — SC-300 Command-Chain Summary

Core Insight

SC-300 tests reasoning, not syntax.

You must infer:

  • which object is missing
  • what relationship is missing
  • which command fixes it

Identity Object Responsibilities

  • Tenant

    • Security boundary
    • Never granted permissions

  • Application Object

    • Requests permissions
    • Defines OAuth behavior
    • Never receives consent

  • Service Principal

    • Receives permission grants
    • Enforces consent
    • Can be assigned users

  • Resource API

    • Defines permissions
    • Immutable

Permission Flow (Always This Order)

  1. Permission exists on resource
  2. App requests permission
  3. Tenant grants permission to service principal

Exam Pattern

If question says:

“App cannot access Graph”

Think:

  • Is permission missing?
  • Is consent missing?
  • Is it delegated or application?

Delegated vs Application

  • Delegated → user context
  • Application → app identity only

Assignment vs Consent

  • Assignment = who can sign in
  • Consent = what can be accessed

Command-Chain Heuristic

If command:

  • changes requested permissions → Application Object
  • grants access → Service Principal
  • reads state → GET
  • creates relationship → NEW / ADD

Final Rule

If you know:

  • which object
  • which relationship
  • which direction

The command choices become obvious.

End Summary