Question
A payroll API receives a signed, unexpired Microsoft Graph access token containing a directory-read scope. The caller also has a Payroll Reader directory-role assignment. Why must the payroll API still reject the request?
Flashcard practice
Practice multiple choice certification questions for Microsoft 365 Certified: Copilot and Agent Administration Fundamentals (AB-900) and review the explanation after each answer.
A payroll API receives a signed, unexpired Microsoft Graph access token containing a directory-read scope. The caller also has a Payroll Reader directory-role assignment. Why must the payroll API still reject the request?
Read aloud starts automatically.
Guest checks show correctness and the answer key. Log in to save history and unlock evaluator notes.
i Review the explanation and try similar questions to strengthen your understanding.
Issue reporting
Clara
Search across lessons, syllabus topics, provider capabilities, and certification questions.