AI-102 Implement an agentic solution Practice Question

Exhibit

{
  "type": "Microsoft.Agents/agent",
  "apiVersion": "2025-01-01-preview",
  "properties": {
    "displayName": "SupportAgent",
    "description": "Agent for IT support",
    "actions": [
      {
        "type": "conversation",
        "id": "resetPassword",
        "authentication": {
          "type": "ManagedIdentity",
          "resourceId": "/subscriptions/.../userAssignedIdentities/support-identity"
        },
        "parameters": {
          "endpoint": "https://graph.microsoft.com/v1.0/users/{userId}/resetPassword",
          "method": "POST"
        }
      }
    ],
    "knowledgeStores": [
      {
        "type": "azureAISearch",
        "connectionReference": "search-connection"
      }
    ]
  }
}

Refer to the exhibit. You are deploying an agent in Microsoft Foundry using the ARM template snippet above. The agent needs to call Microsoft Graph API to reset a user's password. However, the deployment fails with an authorization error. What is the most likely cause?

⚠ Common exam trap

Many exam-takers confuse delegated permissions (used for user-context operations) with application permissions (used for service-to-service calls), and assume the managed identity automatically has Graph permissions without explicit assignment.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The managed identity does not have the 'User.ReadWrite.All' delegated permission for Microsoft Graph.

The agent uses a managed identity to authenticate to Microsoft Graph, and the error indicates an authorization failure. For the agent to call Graph API to reset a user's password, the managed identity must be granted the 'User.ReadWrite.All' application permission (not delegated) via an API permission assignment in Azure AD. Without this permission, the Graph API returns a 403 Forbidden error, even if the endpoint and ARM template syntax are correct.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The Graph API endpoint URL is incorrect.
Why it's wrong here
The URL is correct for resetting password.
✗
The apiVersion '2025-01-01-preview' is not supported for agent deployments.
Why it's wrong here
Preview versions are supported for testing.
✓
The managed identity does not have the 'User.ReadWrite.All' delegated permission for Microsoft Graph.
Why this is correct
The identity must be granted Graph API permissions.
✗
The resourceId for managed identity is missing the 'Microsoft.ManagedIdentity/userAssignedIdentities' resource type.
Why it's wrong here
The resourceId format is correct.

About these practice questions

Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

Last reviewed: Jul 4, 2026

Question Discussion

Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.

Loading comments…

This AI-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AI-102 exam.