Implement an agentic solution →hardMultiple ChoiceObjective-mapped

AI-102 Implement an agentic solution Practice Question

Exhibit

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "resources": [
    {
      "type": "Microsoft.Agents/agent",
      "apiVersion": "2025-01-01-preview",
      "name": "MyAgent",
      "properties": {
        "displayName": "MyAgent",
        "model": {
          "provider": "AzureAI",
          "name": "gpt-4o"
        },
        "actions": [
          {
            "type": "openApi",
            "id": "weatherApi",
            "authentication": {
              "type": "ManagedIdentity",
              "resourceId": "[resourceId('Microsoft.ManagedIdentity/userAssignedIdentities', 'agent-identity')]"
            },
            "parameters": {
              "url": "https://api.weather.example.com/current"
            }
          }
        ]
      }
    }
  ]
}

Refer to the exhibit. You deploy this ARM template to create an agent. The agent uses a user-assigned managed identity to call an external weather API. The deployment succeeds but the agent fails to authenticate to the weather API. What is the most likely reason?

⚠ Common exam trap

The exam often tests the misconception that managed identity tokens are universally accepted by any API, when in fact the target API must be registered in the same tenant or explicitly configured to trust tokens from the managed identity's tenant.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The external weather API is not configured to accept tokens from the managed identity's tenant.

The agent uses a user-assigned managed identity to authenticate to an external weather API. Managed identities provide tokens that are valid only within the Microsoft Entra ID (formerly Azure AD) tenant where the identity is registered. For the agent to successfully authenticate, the external weather API must be configured as an application in that same tenant and trust tokens issued by that tenant. Option D correctly identifies that the most likely reason for authentication failure is that the external weather API is not configured to accept tokens from the managed identity's tenant, meaning the API does not trust the token issuer.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The resourceId for the managed identity is incorrect.
Why it's wrong here
The format is correct.
✗
The model provider 'AzureAI' should be 'AzureOpenAI'.
Why it's wrong here
AzureAI is a valid provider.
✗
The URL parameter is missing the API version.
Why it's wrong here
Missing API version might cause a different error.
✓
The external weather API is not configured to accept tokens from the managed identity's tenant.
Why this is correct
The API must trust the identity's token.

Go deeper

AI-102 Implement an agentic solution Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question