Examkin

Question

Difficulty: EasyMicrosoft Identity Platform Authentication

You are developing an ASP.NET Core web application that will authenticate users using the Microsoft Identity Platform and then call a downstream web API. You need to configure Microsoft Entra ID and the application to enable this confidential client authentication scenario. Which two configuration steps are required? (Select two.)

  1. Configure the Redirect URI in the Microsoft Entra ID app registration to match the application's sign-in callback endpoint.Answer
  2. Generate a client secret or upload a certificate in the Microsoft Entra ID app registration for the application to authenticate itself.Answer
  3. C
    Enable a system-assigned managed identity on the hosting Azure resource to authenticate the end-users signing into the web application.
  4. D
    Generate a Shared Access Signature (SAS) token to authenticate the web application client against the Microsoft Identity Platform token endpoint.

Answer

To configure a web application that authenticates users and calls a downstream web API (confidential client flow), you must configure the Redirect URI in the Microsoft Entra ID app registration and generate a client secret or certificate in the app registration to allow the confidential client to authenticate during token exchange.
For a web application that authenticates users and calls a downstream web API (confidential client), you must configure: 1) the Redirect URI so the user agent is returned to the correct endpoint after authentication, and 2) a client secret or certificate to authenticate the web app when it exchanges the authorization code for an access token. The options specifying Redirect URI configuration and generating a client secret/certificate are correct.

Step-by-Step Solution

1
Create an application registration in the Microsoft Entra admin center.
The application obtains a client ID and tenant ID required for configuring the MSAL client.
This establishes the identity of the web application in Microsoft Entra ID.
2
Add a Redirect URI of type 'Web' matching the local application URL (e.g., https://localhost:5001/signin-oidc).
Microsoft Entra ID is allowed to send the authorization code to the specified application endpoint.
Redirect URIs prevent tokens from being redirected to unauthorized endpoints.
3
Generate a client secret under the Certificates & Secrets blade of the registration.
The web app can use this secret credential to prove its identity during code exchange.
Confidential client applications must authenticate themselves when requesting access tokens using the authorization code flow.

Key Concept

Confidential Client Application configuration in Microsoft Identity Platform authentication
Estimated Time:1m 0s
Rate this question

Topics

Microsoft Identity Platform Authentication

More questions from this topic