Examkin

Question

Difficulty: Very hardMicrosoft Identity Platform Authentication

You are developing a secure background daemon application in C# that runs as an on-premises scheduled task. The application must periodically retrieve records from a secured downstream Azure Web API. The organization's security policy strictly prohibits the use of client secrets (passwords) for authentication. Instead, you must authenticate using a client certificate. You have already registered the daemon application in Microsoft Entra ID.

Which two of the following actions must you perform to configure the application registration and implement the authentication flow using MSAL.NET? (Select two.)

  1. In the C# application code, retrieve the certificate and instantiate the client using ConfidentialClientApplicationBuilder.Create(clientId).WithCertificate(certificate).WithAuthority(AzureCloudInstance.AzurePublic, tenantId).Build().Answer
  2. In the Microsoft Entra admin center, select the registered application, navigate to Certificates & secrets, select the Certificates tab, upload the public key file (.cer) of the certificate, and save.Answer
  3. C
    In the C# application code, retrieve the certificate and instantiate the client using PublicClientApplicationBuilder.Create(clientId).WithCertificate(certificate).Build().
  4. D
    In the Microsoft Entra admin center, select the registered application, navigate to API permissions, select Add a permission, select Microsoft Graph, select Delegated permissions, and grant consent for the User.Read.All scope.

Answer

The application must be configured in Microsoft Entra ID by uploading the public key (.cer) to the Certificates tab of the Certificates & secrets page, and implemented in C# by instantiating the client using ConfidentialClientApplicationBuilder.Create(clientId).WithCertificate(certificate).WithAuthority(AzureCloudInstance.AzurePublic, tenantId).Build().
For a daemon application to authenticate securely using a certificate, it must register the public key in Microsoft Entra ID under the application's Certificates & secrets section, and the application code must use the ConfidentialClientApplicationBuilder class with the WithCertificate method to sign the client assertion and acquire tokens.

Step-by-Step Solution

1
Upload the public key file (.cer) of the certificate to the daemon application registration in Microsoft Entra ID.
Microsoft Entra ID has the public key needed to verify assertions signed by the application.
This establishes trust between Microsoft Entra ID and the daemon application without relying on a password-like client secret.
2
Use ConfidentialClientApplicationBuilder in the C# code, passing the private key certificate using the WithCertificate method.
The application is configured as a confidential client and is ready to generate signed client assertions for authentication.
Daemon applications run in secure server environments and are capable of maintaining credentials, which requires the confidential client application model rather than the public client application model.

Key Concept

Daemon applications using MSAL.NET and Microsoft Identity Platform must act as confidential client applications and authenticate using client credentials (either client secrets or client certificates). In Entra ID, the public key of the certificate is registered, while the private key is used in C# code with the ConfidentialClientApplicationBuilder to acquire a token.
Rate this question

Topics

Microsoft Identity Platform Authentication

More questions from this topic