AZ-204 Implement Azure security Practice Question
A background service must call Microsoft Graph without a signed-in user. Which Microsoft identity platform permission model is required?
⚠ Common exam trap
Many exam-takers confuse delegated permissions (which require a user) with application permissions (which do not), and mistakenly choose the device code flow thinking it works without a user, when in fact it still requires user authentication via a browser.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Application permissions with client credentials flow
When a background service or daemon calls Microsoft Graph without a signed-in user, it must authenticate as itself using application permissions (app roles) rather than delegated permissions. The client credentials flow (OAuth 2.0 grant type) allows the service to obtain an access token using its own credentials (client ID and client secret or certificate), without any user interaction. This flow is designed for server-to-server scenarios where the application acts on its own behalf.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Password hash synchronization
Why it's wrong here
Password hash synchronization is an identity synchronization method used to replicate user credentials from an on-premises Active Directory to Azure Active Directory. It facilitates user authentication to cloud services by syncing a hash of the user's password, but it does not provide a mechanism for an application to authenticate itself or obtain API permissions to Microsoft Graph without a signed-in user. This method is entirely unrelated to how an application acquires tokens for API access.
- ✗
Delegated permissions only
Why it's wrong here
Delegated permissions are designed for scenarios where an application acts on behalf of a signed-in user. These permissions allow the application to access resources that the user themselves has access to, within the scope of the granted permissions. Since the question specifies a background service operating 'without a signed-in user', delegated permissions are unsuitable because there is no user context for the application to delegate actions from.
- ✗
Device code flow
Why it's wrong here
The Device Code Flow is an OAuth 2.0 authorization grant type primarily used for user sign-in on input-constrained devices, such as smart TVs or IoT devices, that lack a web browser or easy input capabilities. While it enables user authentication, it still fundamentally requires user interaction to complete the sign-in process by visiting a URL and entering a code. A background service, by definition, operates autonomously without any user interaction, making this flow inappropriate for its authentication needs.
- ✓
Application permissions with client credentials flow
Why this is correct
Application permissions, combined with the client credentials flow, are the correct approach for a background service (daemon application) that needs to call Microsoft Graph without a signed-in user. Application permissions are granted directly to the application's service principal, allowing it to act as itself and access data across all users or specific resources, independent of any user context. The client credentials flow is the OAuth 2.0 grant type where the application authenticates directly to Azure AD using its client ID and a client secret or certificate to obtain an access token.
Go deeper
Related to this question
Learn chapter
App Service Development
Key term
Azure AD B2C
Azure AD B2C is a cloud identity service that lets you customize and control how your customers sign up, sign in, and manage their profiles when using your applications.
Key term
Microsoft Identity Platform
Microsoft Identity Platform is a unified authentication and authorization service that enables applications to sign in users and access resources using Microsoft Entra ID and modern protocols.
About these practice questions
One of 881 original AZ-204 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.