Examkin

Question

Difficulty: MediumApp Registrations and Service Principals

You are developing a background utility service that runs on an on-premises Windows server. The service must periodically retrieve diagnostic data from a secure custom web API protected by Microsoft Entra ID. You register the utility as an application in your Microsoft Entra ID tenant. The service must authenticate programmatically without user interaction using a certificate. Which two configuration steps should you perform? (Choose two.)

  1. Upload the public key portion of the certificate to the application registration in Microsoft Entra ID.Answer
  2. Configure the application to request an access token using the OAuth 2.0 client credentials grant flow.Answer
  3. C
    Configure a system-assigned managed identity on the on-premises server and grant it permissions to access the API.
  4. D
    Create an Azure Key Vault access policy that grants the custom web API permission to retrieve the private key of the certificate.

Answer

Upload the public key portion of the certificate to the application registration in Microsoft Entra ID, and configure the application to request an access token using the OAuth 2.0 client credentials grant flow.
For background services running on-premises, authentication is performed via the OAuth 2.0 client credentials flow. Since a certificate is required for authentication, the public key (.cer) must be uploaded to the Microsoft Entra ID application registration. The client service then signs its client assertion locally using the corresponding private key to request an access token.

Step-by-Step Solution

1
Determine the application type and authentication flow.
Since the service runs on-premises as a background process without user interaction, it cannot use managed identity or delegated permissions. It must authenticate using the client credentials flow with a certificate.
Managed identities require Azure hosting, and user-interactive flows are not suitable for background automation.
2
Configure the credentials on the Microsoft Entra ID application registration.
Upload the public key (.cer) of the certificate to the registered application.
Microsoft Entra ID needs the public key to verify the signature of the token request signed by the client's private key.
3
Implement the token request logic in the client application.
Acquire a token from Microsoft Entra ID using the OAuth 2.0 client credentials flow, passing the client assertion signed with the private key.
This retrieves the access token needed to authenticate calls to the custom web API.

Key Concept

Application registration authentication using certificates and client credentials flow
Rate this question

Topics

App Registrations and Service Principals

More questions from this topic