Examkin

Question

Difficulty: EasyMicrosoft Identity Platform Authentication

You are developing a command-line interface (CLI) application that will run on Linux servers without a graphical user interface or local web browser. The application must authenticate individual users against Microsoft Entra ID before executing commands. Which MSAL.NET method should you use to perform the authentication?

  1. A
    AcquireTokenInteractive
  2. B
    AcquireTokenForClient
  3. AcquireTokenWithDeviceCodeAnswer
  4. D
    AcquireTokenByUsernamePassword

Answer

The correct option is AcquireTokenWithDeviceCode, which initiates the Device Code Flow for environments without a local web browser.
The method AcquireTokenWithDeviceCode executes the OAuth 2.0 Device Authorization Grant. This flow provides the user with an verification URL and a code to perform authentication on a separate, browser-equipped device, making it ideal for headless command-line interfaces.

Step-by-Step Solution

1
Analyze the execution environment constraints.
The CLI application runs on a headless Linux server with no GUI or local web browser.
This rules out standard interactive flows that rely on launching a local system browser.
2
Identify the authentication subject.
The application must authenticate individual users (delegated permissions), not the application itself.
This rules out client credential flows meant for daemon/service identity.
3
Select the appropriate OAuth 2.0 flow for headless user authentication.
The Device Code Flow is designed for this scenario, allowing the user to sign in on a separate device using a code and a browser.
The MSAL.NET library implements this flow using the AcquireTokenWithDeviceCode method.

Key Concept

Microsoft Identity Platform Device Code Flow
Rate this question

Topics

Microsoft Identity Platform Authentication

More questions from this topic