OAuth 2.0 Authorization Code Flow with PKCE for Microsoft Graph API Delegated Permissions
You are building an agentic solution that needs to perform actions on behalf of the user, such as sending emails and updating calendars. Which authentication approach should you use for the agent to access Microsoft Graph API with delegated permissions?
Quick Answer
The answer is the OAuth 2.0 authorization code flow with PKCE. This is the correct choice because it is the only flow designed for native or client-side applications that need to obtain delegated permissions—acting on behalf of a signed-in user—while securely preventing authorization code interception attacks via the Proof Key for Code Exchange (PKCE) extension. On the Microsoft Azure AI Engineer Associate AI-102 exam, this scenario often appears in questions about building agentic solutions that require user-context actions, such as sending emails or updating calendars via Microsoft Graph API. A common trap is selecting the client credentials flow, which is for app-only access without a user, or the deprecated implicit flow. Remember the memory tip: “PKCE for people, client creds for code”—if a user is involved, always reach for PKCE.
⚠ Common exam trap
Watch out — candidates often confuse the client credentials flow (app-only) with delegated scenarios, assuming any server-side agent should use client credentials, but the requirement to act on behalf of a user mandates delegated permissions and user authentication.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
OAuth 2.0 authorization code flow with PKCE
The authorization code flow with PKCE is the correct approach because the agent needs to act on behalf of a signed-in user, requiring delegated permissions. This flow securely exchanges an authorization code for an access token, and PKCE adds a cryptographic challenge to prevent interception attacks, making it ideal for public clients like agent applications.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
OAuth 2.0 client credentials flow
Why it's wrong here
This flow grants app-only permissions, not delegated.
- ✓
OAuth 2.0 authorization code flow with PKCE
Why this is correct
This flow is secure and allows delegated permissions.
- ✗
OAuth 2.0 implicit flow
Why it's wrong here
Implicit flow is deprecated and not recommended.
- ✗
OAuth 2.0 device code flow
Why it's wrong here
Device code flow is for input-constrained devices.
Go deeper
Related to this question
About these practice questions
Courseiva writes every AI-102 question from scratch — 945 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on AI-102
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. You are building an agentic solution using Azure AI Agent Service. The agent needs to send an email via Microsoft Graph API. Which authentication method should you use for the action?
easy- A.Client Certificate
- B.API Key
- ✓ C.OAuth 2.0
- D.Basic Authentication
Why C: Microsoft Graph API requires OAuth 2.0 for authentication because it uses delegated or application permissions to access user data securely. Azure AI Agent Service can use OAuth 2.0 with a managed identity or service principal to obtain an access token for the Graph API, ensuring proper authorization and compliance with Microsoft's security model.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AI-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AI-102 exam.