Examkin

Question

Difficulty: HardApp Registrations and Service Principals

You are developing a secure daemon service that runs on an on-premises Linux server. The service must authenticate with Microsoft Entra ID to retrieve secrets from an Azure Key Vault. Security policies prohibit the use of client secrets (passwords) for daemon services, requiring certificate-based authentication instead. You generate a self-signed certificate on the Linux server and register the application in Microsoft Entra ID under the name OnPremDaemon. Which configuration step must you perform in Microsoft Entra ID to enable the service to authenticate using this certificate?

  1. Upload the public key (.cer or .pem) of the certificate to the Certificates & secrets section of the OnPremDaemon app registration, which populates the keyCredentials property in the application object.Answer
  2. B
    Upload the private key (.pfx) of the certificate to the Certificates & secrets section of the OnPremDaemon app registration, which populates the passwordCredentials property in the application object.
  3. C
    Enable a system-assigned managed identity for the OnPremDaemon application registration and configure it to trust the certificate's thumbprint.
  4. D
    Configure the certificate's public key within a custom Shared Access Signature (SAS) policy associated with the OnPremDaemon service principal.

Answer

Upload the public key (.cer or .pem) of the certificate to the Certificates & secrets section of the OnPremDaemon app registration, which populates the keyCredentials property in the application object.
To configure certificate-based authentication, the public key (.cer or .pem) of the certificate must be uploaded to the app registration. This action populates the keyCredentials array in the application object. When the daemon application authenticates, it signs a client assertion (JWT) using its private key and sends it to the token endpoint. Microsoft Entra ID uses the registered public key to verify the signature of the assertion.

Step-by-Step Solution

1
Extract the public key from the generated certificate on the Linux server.
A public key file in .cer or .pem format is obtained.
Only the public key is needed by Microsoft Entra ID to verify signatures, while the private key remains secure on the host.
2
Navigate to the Microsoft Entra ID portal, open the App registrations blade, and select the OnPremDaemon application.
The application registration details page is displayed.
Credentials must be configured on the application registration representing the daemon service.
3
Go to the Certificates & secrets section, click on Upload certificate, and select the public key file.
The certificate is successfully uploaded and its thumbprint, start date, and expiration date are visible.
This action registers the certificate under the keyCredentials array of the application object, enabling Microsoft Entra ID to validate token requests signed with the corresponding private key.

Key Concept

App Registrations and Service Principals credentials configuration using certificates
Rate this question

Topics

App Registrations and Service Principals

More questions from this topic