AI-102 Implement an agentic solution Practice Question
An organization uses Microsoft Copilot Studio to create an agent for IT support. The agent should be able to reset passwords, unlock accounts, and look up user information by connecting to on-premises Active Directory via Microsoft Entra ID. Which type of authentication should be used for the agent to access these actions?
⚠ Common exam trap
Test-takers frequently confuse certificate-based authentication (often used for daemon apps) with the on-behalf-of flow, not realizing that Copilot Studio agents require delegated user context and token exchange rather than a static identity.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
OAuth 2.0 authentication with Microsoft Entra ID using on-behalf-of flow.
The agent needs to securely access on-premises Active Directory through Microsoft Entra ID. OAuth 2.0 with the on-behalf-of (OBO) flow allows Copilot Studio to obtain a token for the agent's identity, then exchange it for a token to call downstream APIs (like Microsoft Graph or a custom API) that interact with AD. This provides delegated access and supports modern authentication without exposing static credentials.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Basic authentication with username and password.
Why it's wrong here
Basic authentication is insecure and not recommended.
- ✗
API key authentication to the on-premises API.
Why it's wrong here
API keys do not support user-specific authorization and are not secure for this scenario.
- ✗
Certificate-based authentication for the agent's identity.
Why it's wrong here
Certificate-based auth is for server-to-server, not for user delegation.
- ✓
OAuth 2.0 authentication with Microsoft Entra ID using on-behalf-of flow.
Why this is correct
On-behalf-of flow allows the agent to obtain tokens to call downstream APIs on behalf of the user.
Go deeper
Related to this question
About these practice questions
One of 945 original AI-102 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AI-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AI-102 exam.