Examkin

Question

Difficulty: MediumMicrosoft Identity Platform Authentication

You are developing a C# background daemon service that will run on an on-premises server. The service must periodically authenticate to the Microsoft Identity Platform without user interaction and retrieve files from a protected web API. You decide to use a client certificate stored in Azure Key Vault for authentication. The daemon service has an application registration in Microsoft Entra ID. Which two actions must you perform to configure the authentication flow and permissions? (Select two.)

  1. In the Microsoft Entra ID application registration, upload the public key (.cer file) of the client certificate.Answer
  2. Create an Azure Key Vault access policy that grants the application's service principal Get Secret and Get Certificate permissions.Answer
  3. C
    In the Microsoft Entra ID application registration, upload the private key (.pfx file) of the client certificate.
  4. D
    Instantiate the application in code using PublicClientApplicationBuilder to enable certificate-based authentication.

Answer

To configure the authentication flow, you must upload the public key (.cer file) of the client certificate to the application registration in Microsoft Entra ID, and create an Azure Key Vault access policy that grants the application's service principal Get Secret and Get Certificate permissions.
To set up certificate authentication for a daemon application, you must upload the public key (.cer file) of the certificate to the application registration in Microsoft Entra ID. The application then uses the private key to sign the client assertion. Because the private key is stored securely in Azure Key Vault, you must grant the application's service principal Get Secret and Get Certificate permissions in the Key Vault access policy to retrieve the certificate at runtime.

Step-by-Step Solution

1
Register the client certificate's public key with Microsoft Entra ID.
The public key (.cer file) is associated with the app registration.
Microsoft Entra ID requires the public key to validate token requests signed with the corresponding private key.
2
Authorize the daemon service to retrieve the certificate from Azure Key Vault.
The application's service principal is granted Get Secret and Get Certificate permissions in the Key Vault access policy.
The C# application must load the certificate (containing the private key) from the Key Vault at runtime to construct the client assertion.

Key Concept

Daemon applications are confidential clients that authenticate to the Microsoft Identity Platform using client credentials, such as certificates. This configuration requires registering the public key in Microsoft Entra ID and securely granting access to the private key in Key Vault.
Estimated Time:1m 30s
Rate this question

Topics

Microsoft Identity Platform Authentication

More questions from this topic