OAuth 2.0 Authorization Code Flow with PKCE for Microsoft Graph API Delegated Permissions
You are building an agentic solution using Azure AI Agent Service. The agent needs to send an email via Microsoft Graph API. Which authentication method should you use for the action?
⚠ Common exam trap
Azure certification exams often test the misconception that API keys or basic authentication can be used with modern REST APIs like Microsoft Graph, but the trap here is that candidates overlook the mandatory OAuth 2.0 requirement for Microsoft Graph API and the deprecation of basic authentication in Azure services.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
OAuth 2.0
Microsoft Graph API requires OAuth 2.0 for authentication because it uses delegated or application permissions to access user data securely. Azure AI Agent Service can use OAuth 2.0 with a managed identity or service principal to obtain an access token for the Graph API, ensuring proper authorization and compliance with Microsoft's security model.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Client Certificate
Why it's wrong here
Client certificates authenticate the application itself to Microsoft Entra ID, but the agent must act on behalf of a signed-in user to send an email via Microsoft Graph API, which requires delegated permissions and an OAuth 2.0 authorization code flow. This option is tempting because client certificates are a robust, secretless authentication method often used for server-to-server scenarios where no user context is needed, such as daemon applications calling Graph with application permissions.
- ✗
API Key
Why it's wrong here
API keys cannot authenticate to Microsoft Graph, which requires OAuth 2.0 tokens issued by Microsoft Entra ID with a consented permission scope. The agent therefore cannot obtain a Graph access token via an API key. API keys suit services validating a static secret themselves, such as Azure OpenAI or Cognitive Services endpoints, not delegated Graph mail sending.
- ✓
OAuth 2.0
Why this is correct
OAuth 2.0 provides delegated, scoped access tokens that Microsoft Graph requires for sending mail on a user's behalf. It satisfies the authentication constraint for Graph API actions, unlike API keys or connection strings, which Graph does not accept.
- ✗
Basic Authentication
Why it's wrong here
Microsoft Graph has deprecated basic authentication, requiring OAuth 2.0 bearer tokens issued by Microsoft Entra ID; username and password credentials are rejected outright. It tempts because basic auth once worked against Exchange Web Services, but Graph endpoints enforce modern authentication for all mail operations.
Go deeper
Related to this question
About these practice questions
This AI-102 question is part of Courseiva's 761-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AI-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AI-102 exam.