Examkin

Question

Difficulty: HardMicrosoft Identity Platform Authentication

You are developing a Single Page Application (SPA) using React and MSAL.js 2.x2.\text{x}. The application must authenticate users using the Microsoft Identity Platform and call a downstream secured Microsoft Graph API. You register the application in the Microsoft Entra admin center. Under the Authentication blade, you add a redirect URI of `http://localhost:3000` but configure the platform type as Web instead of Single-page application. During testing, users can successfully sign in and the application receives an authorization code. However, when the application attempts to exchange the authorization code for an access token, the token endpoint returns an error. You need to resolve the error and ensure that the application can successfully acquire access tokens. Which of the following actions should you perform?

  1. A
    In the app registration, enable the Implicit Grant flow by checking both Access tokens and ID tokens.
  2. In the app registration, change the redirect URI platform type from Web to Single-page application.Answer
  3. C
    In the app registration, generate a client secret and configure the React application to use this secret in the token request.
  4. D
    Configure the React application to use a system-assigned managed identity to authenticate directly against the Microsoft Graph API.

Answer

Change the redirect URI platform type from Web to Single-page application in the app registration.
The correct action is to change the redirect URI platform type from Web to Single-page application. Microsoft Identity Platform requires browser-based SPAs to use the Single-page application platform type, which supports the Authorization Code Flow with Proof Key for Code Exchange (PKCE). This configuration allows the token endpoint to safely exchange the authorization code for an access token without requiring a client secret, which cannot be kept secure in a browser-based environment.

Step-by-Step Solution

1
Identify the client application type and the authentication requirements.
The application is a browser-based Single Page Application (SPA) requiring user login and token acquisition for Microsoft Graph.
Understanding the application architecture helps in selecting the correct OAuth 2.0 flow.
2
Determine why the token exchange request is failing when using the 'Web' platform registration.
The 'Web' platform registration expects a client secret for authorization code redemption, which the SPA cannot provide.
Public clients like SPAs cannot securely store credentials on the client-side.
3
Select the correct platform registration configuration in Microsoft Entra ID.
Configure the platform type as 'Single-page application' (SPA) to enable the Authorization Code Flow with PKCE.
The SPA platform registration tells Microsoft Identity Platform to allow public token exchange without a client secret.

Key Concept

Single-page application platform registration and PKCE flow requirements in Microsoft Entra ID.
Estimated Time:2m 0s
Rate this question

Topics

Microsoft Identity Platform Authentication

More questions from this topic