Examkin

Question

Difficulty: MediumApp Registrations and Service Principals

A company is deploying a background synchronization service on an external cloud provider's virtual machine. The service requires access to Azure resources. You register the service as an application in Microsoft Entra ID. To comply with corporate security policies, the service must authenticate using a certificate instead of a client secret. Which configuration step must you perform in Microsoft Entra ID to enable this authentication?

  1. Upload the public key of the certificate to the application registration's certificates and secrets settings.Answer
  2. B
    Configure a user-assigned managed identity for the external virtual machine and assign the certificate to the identity.
  3. C
    Create an Azure Key Vault access policy that grants GET permissions for certificates to the application registration's service principal.
  4. D
    Configure the application to reference the certificate using the @Microsoft.KeyVault syntax in the local configuration file.

Answer

Upload the public key of the certificate to the application registration's certificates and secrets settings.
To authenticate an application registration with a certificate, the public key of the certificate must be uploaded to the app registration's Certificates & secrets settings. The client application then uses its private key to sign a client assertion when requesting a token from Microsoft Entra ID, which Entra ID verifies using the uploaded public key.

Step-by-Step Solution

1
Generate a self-signed or CA-signed certificate and extract its public key (e.g., in .cer format).
You obtain a public key file and a private key file.
The public key will be uploaded to Microsoft Entra ID, while the private key remains secure on the client machine.
2
Navigate to the application registration in Microsoft Entra ID and upload the public key under the Certificates & secrets section.
Microsoft Entra ID registers the certificate and associates it with the application object.
Entra ID needs the public key to verify client assertions signed by the client application using the matching private key.
3
Configure the client application to sign a client assertion JWT using the private key and send it to the Entra ID token endpoint to request an access token.
Microsoft Entra ID validates the signature with the uploaded public key and returns an access token.
This completes the OAuth 2.0 client credentials flow using a certificate instead of a client secret.

Key Concept

Certificate-based authentication for App Registrations and Service Principals in Microsoft Entra ID.
Rate this question

Topics

App Registrations and Service Principals

More questions from this topic