Question

Your organization wants to delegate the ability to update the reply URLs (redirect URIs) of existing application registrations to a team of developers. The developers must NOT be able to create new app registrations, delete apps, or manage credentials such as client secrets. You need to follow least-privilege principles. What should you do?

Accepted Answer

Create a custom role granting the microsoft.directory/applications/basic/update permission and assign it to the developers.

Answer

Assign the developers the built-in Application Administrator role.

Answer

Assign the developers the built-in Cloud Application Administrator role.

Answer

Add the developers as owners of every application registration object.