Apps that call APIs such as Microsoft Graph need permissions, and Microsoft Entra ID uses consent to grant them. Understanding the two permission types and who can consent to them is one of the most tested parts of SC-300, and it's also a real security issue: attackers trick users into consenting to malicious apps, an attack called illicit consent grant.
Free account
Keep reading for free
Create a free StudyToCert account to read the rest of this lesson: 5 more sections, 5 key terms, a real-world example, an exam tip and self-check questions. Every lesson, lab and practice test is free with an account.