Examkin

Question

Difficulty: MediumMicrosoft Identity Platform Authentication

You are developing a command-line interface (CLI) tool in C# that developers will run on Linux servers without a graphical user interface (GUI). The CLI tool must authenticate users against Microsoft Entra ID to access a secure downstream API on their behalf. You need to configure the Microsoft Entra ID application registration and implement the token acquisition logic in the C# code. Which two actions should you perform? (Select two.)

  1. In the Microsoft Entra ID application registration, configure the application as a public client by setting the 'Allow public client flows' option to Yes.Answer
  2. B
    In the C# code, configure the application to use a system-assigned managed identity to authenticate the developer running the tool.
  3. In the C# code, instantiate the client using PublicClientApplicationBuilder and call AcquireTokenWithDeviceCode.Answer
  4. D
    In the C# code, instantiate the client using ConfidentialClientApplicationBuilder and call AcquireTokenForClient with a client secret.

Answer

To authenticate a user from a headless CLI tool running on Linux, you must enable public client flows in the Entra ID application registration, and implement the token acquisition in C# using PublicClientApplicationBuilder and AcquireTokenWithDeviceCode.
To authenticate a user from a headless CLI tool running on a non-Azure environment, the application must be registered as a public client in Microsoft Entra ID with public client flows enabled. In the C# code, the application should be instantiated using the PublicClientApplicationBuilder, and the token should be acquired using the AcquireTokenWithDeviceCode method. This allows the user to complete authentication on another device that has a web browser.

Step-by-Step Solution

1
Identify the client application type and environment constraints.
The CLI tool runs on non-Azure Linux servers without a GUI, meaning it is a public client and cannot use interactive web browser redirects.
This determines that the Device Code flow is the appropriate OAuth 2.0 flow for user authentication.
2
Configure the Microsoft Entra ID application registration.
Enable the 'Allow public client flows' toggle (set to Yes) in the Authentication settings of the app registration.
Public clients like CLI tools must be explicitly allowed to use device code or username/password flows in Entra ID.
3
Implement the token acquisition logic in C#.
Use MSAL.NET's PublicClientApplicationBuilder to create the client and call AcquireTokenWithDeviceCode.
This invokes the device code flow, prompting the user to authenticate on another device using a verification URI and code.

Key Concept

Configuring Microsoft Identity Platform authentication for public client applications running on headless devices using the Device Code Flow.
Estimated Time:1m 30s
Rate this question

Topics

Microsoft Identity Platform Authentication

More questions from this topic