AZ-204 Implement Azure security Practice Question
A background service must call Microsoft Graph without a signed-in user. Which Microsoft identity platform permission model is required? The design must avoid adding custom operational scripts.
⚠ Common exam trap
Candidates often confuse 'delegated permissions' (which require a user) with 'application permissions' (which do not), often selecting Option B because they think 'permissions' alone suffices, ignoring the 'without a signed-in user' constraint.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Application permissions with client credentials flow
Application permissions with the client credentials flow are required because the background service must call Microsoft Graph without a signed-in user. This flow uses OAuth 2.0 client credentials grant (RFC 6749) where the service authenticates as itself using a client secret or certificate, not on behalf of a user. Delegated permissions (Option B) always require a signed-in user context, making them unsuitable for unattended background services.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Password hash synchronization
Why it's wrong here
Password hash synchronization (PHS) is a method for synchronizing user identities and their password hashes from an on-premises Active Directory to Azure Active Directory. Its primary function is to enable users to sign in to cloud services using the same credentials they use on-premises. PHS is an identity synchronization mechanism and has no direct role in how an application authenticates itself to an API like Microsoft Graph or in defining API permission models for service-to-service communication.
- ✗
Delegated permissions only
Why it's wrong here
Delegated permissions are used when an application needs to access resources on behalf of a signed-in user. The application is granted permission by an administrator, but the actual access token issued to the application will contain the user's identity and their effective permissions. Since the question specifies a background service operating 'without a signed-in user,' delegated permissions are unsuitable as they fundamentally require a user context to be present for authorization.
- ✗
Device code flow
Why it's wrong here
The Device Code Flow is an OAuth 2.0 authorization grant designed for input-constrained devices, such as smart TVs or IoT devices, where a user cannot directly enter credentials. It involves the user navigating to a separate browser on another device to complete the authentication process by entering a provided code. This flow is inherently interactive and requires user intervention, making it inappropriate for a non-interactive background service that needs to operate autonomously without any user present.
- ✓
Application permissions with client credentials flow
Why this is correct
Application permissions allow an application to access data in Microsoft Graph as itself, without a user context, making them ideal for background services or daemon applications. When combined with the client credentials flow, the application authenticates directly to Azure AD using its own credentials (e.g., client secret or certificate) to obtain an access token. This token grants the application the specific permissions it has been configured for, enabling it to call Microsoft Graph autonomously and fulfill the requirement of operating without a signed-in user.
Go deeper
Related to this question
Learn chapter
App Service Development
Key term
Microsoft Identity Platform
Microsoft Identity Platform is a unified authentication and authorization service that enables applications to sign in users and access resources using Microsoft Entra ID and modern protocols.
Key term
Azure AD B2C
Azure AD B2C is a cloud identity service that lets you customize and control how your customers sign up, sign in, and manage their profiles when using your applications.
About these practice questions
One of 881 original AZ-204 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.