A bog-cotton weaver API must allow Dispatcher apps to POST jobs and forbid Viewer apps. How should the developer enforce that authorization?
Select an answer to reveal the explanation.
Short Explanation
App roles are the API’s own job titles—Dispatcher vs Viewer—stamped into the token. Check the roles claim; don’t reach for subscription RBAC for this.
Full Explanation
Application roles defined on the bog-cotton weaver API’s Entra app registration are the right authorization model for Dispatcher versus Viewer. Assign those roles to client apps or users, and have the API authorize using the roles claim in the access token. POST job endpoints check for Dispatcher; read-only endpoints may allow Viewer. This keeps business authorization inside the API’s own app registration rather than stretching Azure control-plane RBAC.
Assigning Azure RBAC Owner on the subscription to every Dispatcher user fails least privilege and targets the wrong plane. Subscription Owner manages Azure resources; it does not encode “may POST jobs to this API.” Using Owner for app features is dangerous and unrelated to API role checks.
Embedding the word Dispatcher in a blob container name and parsing it at runtime fails because container names are not an authorization system. Anyone who learns the naming trick can spoof intent, and Storage naming has no binding to Entra role assignments.
Using only Conditional Access named locations while ignoring token claims fails because named locations constrain where sign-in is allowed; they do not distinguish Dispatcher from Viewer after a token is issued. Authorization for API operations still requires roles or scopes in the token (or an equivalent application-layer check tied to identity).
Exam caveat: app roles for APIs typically appear in the access token’s roles claim when using application permissions or assigned app roles; confirm how your assignment (user vs client app) surfaces claims for your chosen OAuth flow.
Operational check: assign Dispatcher to a test client, acquire an access token for the API’s application ID URI, decode and confirm roles includes Dispatcher, then verify POST succeeds and that a Viewer-only token receives 403 on POST.