A harbor-operations API needs every employee to use reviewed scopes without a per-user consent prompt. Which consent action should the security engineer take?
Select an answer to reveal the explanation.
Short Explanation
Once the scopes are reviewed, one tenant-wide admin consent lights the green lamp for the whole directory—no clipboard scavenger hunt of adminconsent links on every desk. Pair it with assignment required if you still want a boarding list.
Full Explanation
Tenant-wide admin consent grants the requested permissions for all users in the tenant after those scopes are reviewed, eliminating repetitive per-user consent prompts for an approved application. For a harbor-operations API that needs every employee to use reviewed scopes without a per-user consent prompt, the security engineer should grant tenant-wide admin consent from the app registration or enterprise application once the permission set passes security review.
Emailing each workstation an adminconsent URL and requiring users to paste it weekly fails as an unsustainable and error-prone process that still depends on privileged clicks outside a controlled admin workflow. Enabling Security Copilot to issue per-user consent tickets that expire every hour is not the standard Entra control for this requirement. Assigning Azure Key Vault Contributor to every employee so Graph consent is skipped fails by concept: Key Vault RBAC does not bypass Microsoft Graph consent.
Exam caveat: tenant-wide admin consent is powerful—review least-privilege scopes first, then consent, and monitor the enterprise application’s grants afterward. Operational check: review requested scopes, grant admin consent, sign in as a standard harbor employee, confirm no consent prompt appears for those scopes, and export the grant record for audit.