AZ-204 Implement Azure security Practice Question
A retail company uses Azure Logic Apps to integrate with third-party APIs. One Logic App sends purchase orders to a supplier's HTTP endpoint. The supplier requires that the request include an OAuth 2.0 access token obtained from their authorization server. The company wants to manage the client credentials (client ID and client secret) securely and rotate them automatically. The Logic App must also log all requests for auditing. What should you do?
⚠ Common exam trap
Many exam-takers assume a managed identity can be used to authenticate to any OAuth 2.0 endpoint, but managed identities are limited to Azure AD tokens; for external OAuth 2.0 servers, you must use the client credentials flow with securely stored secrets.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use the 'HTTP + Swagger' connector, define the OAuth2 security scheme, store the client secret in Key Vault, and configure the Logic App to use a system-assigned managed identity to access Key Vault.
It combines the HTTP + Swagger connector to define the OAuth2 security scheme inline, stores the client secret in Azure Key Vault for secure management and automatic rotation, and uses a system-assigned managed identity to access Key Vault without hardcoding credentials. This approach ensures the Logic App can securely retrieve the client secret, request an OAuth 2.0 token from the supplier's authorization server, and log all HTTP requests via the connector's built-in logging capabilities.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use the built-in HTTP action with a system-assigned managed identity and request a token from the supplier's authorization server using the managed identity.
Why it's wrong here
Using a built-in HTTP action with a system-assigned managed identity to request a token from an external supplier's authorization server is incorrect because Azure Managed Identities are designed to authenticate to Azure resources that trust Azure Active Directory. An arbitrary external OAuth 2.0 authorization server typically does not recognize or trust Azure AD managed identity tokens directly for its own authentication flow. Therefore, the managed identity cannot be used as a credential to obtain a token from a third-party OAuth provider.
- ✗
Use the built-in HTTP action in the Logic App, store the client secret in Azure Key Vault, and retrieve it using the Key Vault connector. Then request a token from the supplier's authorization server.
Why it's wrong here
This approach, while securely retrieving the client secret from Azure Key Vault using a Key Vault connector, still requires the Logic App to manually implement the entire OAuth 2.0 client credentials flow using the generic built-in HTTP action. The HTTP action itself does not inherently understand or automate OAuth token acquisition, refresh, or usage. This means the Logic App would need to explicitly construct the token request, parse the response, extract the token, and manage its lifecycle for subsequent API calls, which is complex and error-prone.
- ✗
Use the 'Managed API' connector for the supplier, configure it with client ID and secret in the connection parameters, and enable 'Azure AD Integration' on the Logic App.
Why it's wrong here
Managed API connectors are pre-built by Microsoft or partners for specific, well-known services and their particular authentication mechanisms. They are not designed to be generic or configurable for arbitrary external APIs with custom OAuth 2.0 implementations. While some managed connectors support OAuth, they do so for their specific service's integration, not as a flexible framework for defining new OAuth flows. Enabling 'Azure AD Integration' on the Logic App primarily secures access to the Logic App itself or allows it to authenticate to Azure AD-protected resources, not to an arbitrary external supplier's OAuth server.
- ✓
Use the 'HTTP + Swagger' connector, define the OAuth2 security scheme, store the client secret in Key Vault, and configure the Logic App to use a system-assigned managed identity to access Key Vault.
Why this is correct
The 'HTTP + Swagger' connector, also known as a Custom Connector, is the correct choice as it allows defining the API's structure and security, including OAuth 2.0, through an OpenAPI (Swagger) definition. By specifying the OAuth2 security scheme, the connector automatically handles the token acquisition and refresh process, abstracting this complexity from the Logic App workflow. Storing the client secret in Azure Key Vault, accessed securely via a system-assigned managed identity, ensures robust credential management, compliance, and facilitates secret rotation without code changes.
Go deeper
Related to this question
Learn chapter
Azure Functions Development
Key term
Key Vault Secrets
Key Vault Secrets are secure containers in Microsoft Azure that store sensitive information like passwords, connection strings, and API keys, keeping them encrypted and accessible only to authorized applications and users.
Key term
Managed identity
A managed identity is an automatically managed service principal in Azure that allows your code to authenticate to any service that supports Azure AD authentication without storing credentials.
About these practice questions
Courseiva writes every AZ-204 question from scratch — 881 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.