Correct Answer: Use the OAuth 2.0 client credentials flow; the calling app requests a token with the 'Reports.Read' application permission, and the API validates the token's 'roles' claim
For daemon/service-to-service calls, the OAuth 2.0 client credentials flow is appropriate. The calling application is granted the 'Reports.Read' application permission in Entra ID....
Correct Answer
Use the OAuth 2.0 client credentials flow; the calling app requests a token with the 'Reports.Read' application permission, and the API validates the token's 'roles' claim
Why This Answer Is Correct
For daemon/service-to-service calls, the OAuth 2.0 client credentials flow is appropriate. The calling application is granted the 'Reports.Read' application permission in Entra ID. The API validates the JWT access token's 'roles' claim to enforce authorization.
This question evaluates your knowledge of Azure Active Directory (Entra ID) — a core concept tested in Microsoft Certified: Azure Developer Associate (AZ-204). Understanding Azure Active Directory (Entra ID) is essential for designing scalable, secure, and cost-effective cloud architectures. Mastery of this topic will help you answer scenario-based questions confidently on exam day.
Your organization has multiple cloud accounts. Users in Account A need temporary access to resources in Account B. What Azure Active Directory (Entra ID) feature should you use?
Which Microsoft Entra ID (formerly Azure AD) feature allows users to access cloud applications using their local on-premises passwords without sending the password itself to the cloud?
An administrator wants to ensure that users can only log in from managed devices or from specific IP ranges. Which Entra ID feature should be used?
What is the primary role of 'Microsoft Entra Connect'?
Which Entra ID role is required to manage all aspects of the directory, including creating users and assigning roles?