Examkin

Question

Difficulty: MediumMicrosoft Identity Platform Authentication

A development team is building a native C# client application that runs on domain-joined user workstations. The application needs to request an access token from the Microsoft Identity Platform to query a secure downstream Web API. The solution must support user accounts from any Microsoft Entra ID tenant as well as personal Microsoft accounts. Which approach should the team use to initialize the client application and configure authentication?

  1. A
    Grant access to a shared client secret using a Key Vault access policy and initialize the application using ConfidentialClientApplicationBuilder.
  2. B
    Configure a system-assigned managed identity for the user workstations and initialize the application using ManagedIdentityApplicationBuilder.
  3. Initialize the client application using PublicClientApplicationBuilder.Create(clientId).WithAuthority(AzureCloudInstance.AzurePublic, "common").Build();Answer
  4. D
    Generate a Shared Access Signature (SAS) token for the Web API and configure the client application to authenticate using the token.

Answer

Initialize the client application using PublicClientApplicationBuilder.Create(clientId).WithAuthority(AzureCloudInstance.AzurePublic, "common").Build();
The correct answer initializes the client application as a public client application. Applications running on desktop computers are classified as public clients since they cannot keep client secrets confidential. The 'common' authority endpoint supports logging in users from any organizational directory (multi-tenant) as well as personal Microsoft accounts.

Step-by-Step Solution

1
Determine the client application type based on the execution environment.
Identify that the application runs on user workstations, which makes it a public client application because it cannot securely store secrets.
Public client applications must be initialized using PublicClientApplicationBuilder in MSAL.NET.
2
Identify the required identity providers and tenants for user login.
The requirement specifies supporting both work/school accounts from any tenant and personal Microsoft accounts.
The 'common' authority audience endpoint is designed to support both multi-tenant Entra ID organizations and personal consumer accounts.
3
Combine the builder type and authority configuration into the initialization code.
Instantiate the client app using PublicClientApplicationBuilder.Create(clientId).WithAuthority(AzureCloudInstance.AzurePublic, "common").Build().
This correctly configures the MSAL client for public interactive authentication with the widest account support.

Key Concept

MSAL.NET client application classification and authority selection
Rate this question

Topics

Microsoft Identity Platform Authentication

More questions from this topic