AZ-204 Implement Azure security Practice Question
A company uses Azure API Management (APIM) to expose APIs to external partners. They want to validate JSON Web Tokens (JWTs) from partners' Microsoft Entra ID tenants before requests reach the backend. The solution must support multiple partner tenants and minimize latency. What should you implement?
⚠ Common exam trap
Test-takers frequently confuse the `validate-jwt` policy with the need to configure an OAuth 2.0 authorization server in APIM, but APIM's authorization server is for the API's own token issuance, not for validating tokens from external tenants.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use APIM inbound policy with validate-jwt and specify openid-config URL for each partner tenant.
The `validate-jwt` policy in APIM can be configured with an `openid-config` URL for each partner tenant, allowing APIM to fetch the tenant-specific signing keys and validate JWTs issued by any Microsoft Entra ID tenant. This approach supports multiple tenants without adding a broker or per-tenant authorization servers, and it minimizes latency by performing validation at the APIM gateway before requests reach the backend.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use Azure AD B2C as a token broker between partners and the API.
Why it's wrong here
Azure AD B2C is primarily designed for customer-facing applications, managing consumer identities (e.g., social logins, local accounts) for external users accessing services. It is not intended for enterprise-to-enterprise (B2B) integration scenarios where partner organizations typically use their own corporate identity providers like Azure AD or other SAML/OAuth IdPs. Using B2C here would introduce unnecessary complexity and misalign with the typical identity federation patterns for partners.
- ✗
Configure OAuth 2.0 authorization server in APIM for each partner tenant.
Why it's wrong here
Configuring an OAuth 2.0 authorization server directly within APIM is used when APIM itself needs to issue access tokens to client applications, effectively acting as the identity provider. This approach does not address the requirement to validate JSON Web Tokens (JWTs) that have already been issued by external partner identity providers. The problem statement implies partners are bringing their own tokens, which APIM needs to verify, not issue.
- ✗
Use client certificate authentication in APIM to map certificates to partner tenants.
Why it's wrong here
Client certificate authentication verifies the identity of the client application by validating a presented X.509 certificate against a trusted root or issuer. While it provides strong mutual TLS authentication, it is a separate mechanism from validating JSON Web Tokens (JWTs). This method does not inspect the claims, signature, or expiration of a JWT, which is crucial for authorization and ensuring the token's integrity and validity from an external identity provider.
- ✓
Use APIM inbound policy with validate-jwt and specify openid-config URL for each partner tenant.
Why this is correct
The `validate-jwt` inbound policy in Azure API Management is specifically designed to verify JSON Web Tokens (JWTs) by checking their signature, claims, and expiration. By specifying the `openid-config` URL (also known as the OpenID Connect discovery endpoint) for each partner tenant, APIM can dynamically retrieve the necessary public keys and issuer metadata to validate tokens issued by those respective external identity providers. This method efficiently supports multiple distinct JWT issuers, ensuring robust and scalable authentication for partner integrations.
Go deeper
Related to this question
About these practice questions
Courseiva writes every AZ-204 question from scratch — 881 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.