Azure Delegated and Application permission precedence

user_4458765 0
Viewed 886

I've created a sample web application calling a Web API and using oAuth code grant flow against Azure AD.Application is registered in Azure AD and I have given required permission as well through Azure portal. Everything seems working as expected.

There are two option for permission

  • Delegate Permission

  • Application Permission

Is it recommended to use mix kind of permission set (App + delegate) for your application?

If I give similar kind of permission to my API on both Delegate and Application,which permission set will take precedence? Will it depend on oAuth flow e.g. Code grant or Implicit ?

In my code how can I differentiate these permission sets while accessing the same resource.I want to call on user context only even same type of application permission is already there?

azure-active-directory azure
1 Answers

Application Permissions and Delegated Permissions are completely independent of one another.

Application Permissions apply when you follow the Client Credential Flow (also known as App Only Flow). When you follow this flow, AAD will try to grant permissions to the client application based on the Application Permissions it has predefined in the app registration. These permissions will appear in an App Only Token in the role claim.

In nearly every other flow, where a user is involved (On-Behalf-Of, Authorization Code Grant Flow, Implicit Grant Flow, etc...) AAD will try to grant permissions to the client based on the Delegated Permissions it has predefined. These permissions will appear in App+User tokens in the scp (scope) claim.

You can control the kinds of permissions your app is granted by adjusting the authentication method when getting an access token to a resource.

user_13969770
Related