A bog-cotton weaver API must allow Dispatcher apps to POST jobs and forbid Viewer apps. How should the developer enforce that authorization?
Select an answer to reveal the explanation.
Short Explanation
App roles are the API’s own job titles—Dispatcher vs Viewer—stamped into the token. Check the roles claim; don’t reach for subscription RBAC for this.
Full Explanation
Application roles defined on the protected API’s app registration are assigned to users or client apps and appear in the access token’s roles claim. The API authorizes operations by inspecting that claim. Azure RBAC on subscriptions and resource groups governs Azure control-plane access and is not the primary mechanism for app-level API authorization on AZ-204.