AZ-204 Practice Question: Connect to and consume Azure services and third-party services

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  The API permission for User.Read is not granted

  Why it's wrong here

  A missing API permission, such as User.Read, would typically manifest as an "Insufficient privileges" or "Access denied" (HTTP 403 Forbidden) error *after* an access token has been successfully acquired and presented to the target resource API. The problem described, however, indicates a failure in the initial token acquisition process itself, often related to the authorization request or redirect, rather than an issue with subsequent API calls using an already-obtained token.

• ✗

  The app is using the client credentials flow instead of authorization code flow

  Why it's wrong here

  The client credentials flow is designed for server-to-server communication, where an application authenticates itself directly to Azure AD using its client ID and secret/certificate, without any user interaction or browser redirects. If the web app were incorrectly configured to use this flow, the user interaction, sign-in prompts, and redirect-related issues described in the problem statement would not occur, as the flow bypasses the user entirely.

• ✓

  The redirect URI is not configured in the app registration

  Why this is correct

  In the OAuth 2.0 authorization code flow, Azure AD redirects the user's browser back to a pre-registered redirect URI (also known as a reply URL) on the client application, carrying the authorization code. If this URI is not configured in the Azure AD app registration, or if it does not precisely match the URI used in the authorization request, Azure AD will refuse to issue the authorization code. This critical security measure prevents code interception and is a common cause for token acquisition failures during the initial authorization phase.

• ✗

  The client secret is expired

  Why it's wrong here

  An expired client secret would prevent the application from successfully authenticating itself to Azure AD during the token exchange phase, where the authorization code is exchanged for an access token. This specific issue would typically result in an "Invalid client secret" or "Client authentication failed" error. This error occurs later in the authorization code flow, distinct from problems related to the initial authorization request or redirect URI configuration, which manifest earlier.

Go deeper

Related to this question