AZ-204 Practice Question: Daemon service calling Microsoft Graph with…
A background data pipeline runs on a schedule and must read user profile data from Microsoft Graph. No user is present during execution. The service authenticates to Microsoft Entra ID and calls the Graph API. Which permission type and OAuth 2.0 flow are correct for this scenario?
⚠ Common exam trap
It's easy for candidates to confuse application permissions with delegated permissions, mistakenly thinking a user context is always required for Graph API calls, but the client credentials flow is the correct choice for any background service that operates without a signed-in user.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Application permissions with the client credentials flow, authenticating with the app's client ID and secret (or certificate)
This scenario requires a background service to access Microsoft Graph without any user interaction. Application permissions are designed for such non-interactive, service-to-service calls, and the client credentials OAuth 2.0 flow (defined in RFC 6749 section 4.4) allows the app to authenticate using its own identity (client ID and secret or certificate) to obtain an access token. Delegated permissions would be incorrect because they require a signed-in user context, which is absent here.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Application permissions with the client credentials flow, authenticating with the app's client ID and secret (or certificate)
Why this is correct
Application permissions are granted by an admin via the app registration manifest. The client credentials flow does not require user interaction — the service presents its own credentials to the token endpoint and receives a token scoped to the application. This is the standard pattern for background services, daemons, and scheduled jobs that call Microsoft Graph.
- ✗
Delegated permissions with the authorization code flow, initiating a browser redirect to collect user consent
Why it's wrong here
The authorization code flow requires an interactive browser session where a user signs in and grants consent. A background pipeline running on a schedule cannot open a browser — there is no user present to authenticate. Delegated permissions require a user token.
- ✗
Delegated permissions with the device code flow, prompting a user to authenticate on a separate device
Why it's wrong here
The device code flow still requires a human to open a browser and enter a code. It is designed for devices with limited input capabilities (TVs, IoT devices), not for fully automated background jobs. A scheduled job cannot wait for a human to complete authentication.
- ✗
Application permissions with the on-behalf-of flow, passing the calling user's token to the Graph API
Why it's wrong here
The on-behalf-of (OBO) flow is used when a middle-tier API receives a user token and needs to call a downstream API on the user's behalf. It requires an incoming user access token. A background daemon has no incoming user token to exchange, so OBO cannot be used.
Go deeper
Related to this question
About these practice questions
Courseiva writes every AZ-204 question from scratch — 881 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.