Examkin

Question

Difficulty: MediumMicrosoft Identity Platform Authentication

You are developing a C# command-line interface (CLI) tool that will be executed by system administrators on headless Linux servers. The tool must authenticate the administrators using their individual Microsoft Entra ID credentials to access a secure downstream Web API. The administrators' accounts have multi-factor authentication (MFA) enabled. Which MSAL.NET method should you use to acquire the token?

  1. IPublicClientApplication.AcquireTokenWithDeviceCodeAnswer
  2. B
    IPublicClientApplication.AcquireTokenInteractive
  3. C
    IPublicClientApplication.AcquireTokenByUsernamePassword
  4. D
    IConfidentialClientApplication.AcquireTokenForClient

Answer

IPublicClientApplication.AcquireTokenWithDeviceCode
The method utilizing the Device Code flow is correct because it allows user authentication on headless or input-constrained devices by prompting the user to complete the login process, including any required Multi-Factor Authentication (MFA), on a separate device with a web browser.

Step-by-Step Solution

1
Analyze the environment and constraints.
The application runs on a headless server without a web browser or GUI, and administrators must authenticate individually with MFA-enabled accounts.
This rules out interactive browser flows and non-interactive username/password flows which cannot complete MFA.
2
Identify the required identity type.
The requirement demands individual user authentication rather than application authentication.
This rules out client credential flows (service principals) which only authenticate the application itself.
3
Select the appropriate OAuth 2.0 flow.
The Device Authorization Grant (Device Code Flow) is selected because it permits interactive authentication on a secondary device while running on a headless machine.
Using the Device Code method allows the administrator to complete MFA safely on their primary workstation or phone.

Key Concept

Selecting the correct OAuth 2.0 authentication flow in MSAL.NET for input-constrained and headless environments.
Rate this question

Topics

Microsoft Identity Platform Authentication

More questions from this topic