Microsoft Identity Platform and MSAL · AZ-204: Developing Solutions for Microsoft Azure Implement Azure Security
An ASP.NET Core API receives an access token for the signed-in user and must call a downstream API while preserving that user's identity and permissi…
Practice question from Microsoft Identity Platform and MSAL (AZ-204: Developing Solutions for Microsoft Azure Implement Azure Security), with the correct answer and a step-by-step solution.
hard · MCQ · Q-27CE03
An ASP.NET Core API receives an access token for the signed-in user and must call a downstream API while preserving that user's identity and permissions. The API is registered as a confidential client, and the downstream API has granted the required delegated permission. Which implementation is correct?
- A.Use AcquireTokenForClient with the API's client secret and the downstream API's .default scope
- B.Use AcquireTokenInteractive so the user signs in again for every downstream request
- C.Use AcquireTokenOnBehalfOf with the downstream API's scopes and a UserAssertion created from the incoming access tokenCorrect answer
- D.Forward the incoming access token to the downstream API regardless of its audience
Solution
The OAuth 2.0 On-Behalf-Of flow lets a middle-tier API exchange the incoming user token for a token targeted at the downstream API. MSAL.NET uses AcquireTokenOnBehalfOf with the required downstream scopes and a UserAssertion. Client credentials would represent only the middle tier, and an access token must have the correct audience for the API receiving it.
More from Microsoft Identity Platform and MSAL
- A .NET desktop application needs to sign a user in interactively and call Microsoft Graph on that user's behalf. The application is registe…
- A background Azure App Service must call a protected Azure resource without a signed-in user. The service is registered as a confidential c…
- A web application signs in a user with Microsoft Identity Platform and receives both an ID token and an access token. The application must…
- An app registration is configured to allow accounts in any Microsoft Entra organization, but not personal Microsoft accounts. Which Microso…
Practise more Implement Azure Security
Sign up free for adaptive practice on this chapter, with instant feedback and hints on every question.
Start practising freeFree to start · No credit card needed