Understanding permissions and consent
The Microsoft identity platform follows an authorization model that gives users and administrators control over how data can be accessed using application registrations.
Let's dive in and look at what they are.
Scopes and permissions
The Microsoft identity platform implements the OAuth 2.0 authorization protocol. With OAuth 2.0, an app can access web-hosted resources on behalf of a user. Each web-hosted resource that integrates with the Microsoft identity platform has a unique resource identifier, which is called the Application ID URI.
For example, here you can see a couple of web-hosted resources with their application ID URIs:
- Microsoft Graph: https://graph.microsoft.com
- Azure Key Vault: https://vault.azure.net
Third-party web-hosted resources that are registered in Azure AD also have an Application ID URI configured, and for each of these resources, you can also define a set of permissions. With these permissions...
