AI-102 Implement an agentic solution Practice Question
A company uses Microsoft Copilot Studio to create an agent that helps employees schedule meetings. The agent must access the user's calendar to find free time slots and book meetings. The agent should only work for users who have granted consent. Which authentication and authorization approach should be used?
⚠ Common exam trap
Watch out — candidates often confuse delegated permissions (user-context) with application permissions (tenant-wide), and mistakenly choose the client credentials flow (Option D) because it seems simpler, but it violates the explicit requirement for per-user consent.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure OAuth 2.0 authentication with Microsoft Entra ID and request delegated permissions for Microsoft Graph.
The agent needs to act on behalf of a signed-in user (delegated identity) to access their calendar. OAuth 2.0 with Microsoft Entra ID and delegated permissions for Microsoft Graph allows the agent to request only the scopes (e.g., Calendars.ReadWrite) that the user has consented to, ensuring the agent operates within the user's granted permissions.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Configure OAuth 2.0 authentication with Microsoft Entra ID and request delegated permissions for Microsoft Graph.
Why this is correct
OAuth 2.0 with Microsoft Entra ID and delegated Microsoft Graph permissions ensures the agent acts only on behalf of users who granted consent, scoping calendar access to their own free/busy data. Application permissions would bypass per-user consent, violating the requirement.
- ✗
Use certificate-based authentication for the agent.
Why it's wrong here
Certificate-based authentication proves the agent's own identity to a service; it cannot obtain a delegated token scoped to each individual user's calendar. The stem requires per-user consent and delegated access, which OAuth 2.0 with Microsoft Entra ID provides. Certificates suit daemon or app-only scenarios lacking user context.
- ✗
Use API key authentication to call Microsoft Graph.
Why it's wrong here
API keys authenticate the calling application, not the signed-in employee, so Microsoft Graph cannot enforce per-user calendar permissions or consent. It is tempting because API keys suit server-to-server daemon calls against a single tenant's own data, where no delegated user context or individual consent is required.
- ✗
Use OAuth 2.0 client credentials flow with application permissions.
Why it's wrong here
Client credentials with application permissions grants tenant-wide access with no user consent, so the agent could read any mailbox. Delegated permissions via OAuth 2.0 authorisation code flow are required when acting on behalf of a consenting user.
Go deeper
Related to this question
About these practice questions
This AI-102 question is part of Courseiva's 761-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AI-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AI-102 exam.