A botanical-garden inventory API is called by an internal SPA, and the team plans to reuse User.Read as the only scope. What should the security engineer configure on the inventory app registration instead?
Select an answer to reveal the explanation.
Short Explanation
User.Read is Microsoft Graph’s “who am I,” not a ticket into your garden inventory API. Expose the API, set an app ID URI, and mint your own scope like access_as_user for the SPA to request.
Full Explanation
First-party APIs should expose an application ID URI and define custom scopes (for example access_as_user) so clients request access to that API specifically. Reusing only Microsoft Graph User.Read does not authorize calls to the inventory API’s own audience. Application Proxy publishes on-premises web apps and is not a substitute for Expose an API. Azure RBAC on a resource group does not replace OAuth scopes on the app registration.