Connect to and consume Azure services and third-party services →mediumMultiple ChoiceObjective-mapped
AZ-204 Practice Question: Connect to and consume Azure services and third-party services
You are building an Azure Logic App that must call an external API that uses the OAuth 2.0 authorization code grant. The API requires the user to sign in interactively to grant consent. You want to minimize development effort and securely manage the token lifecycle. Which built-in action and authentication method should you use?
⚠ Common exam trap
Candidates often confuse 'Managed identity' (which is for Azure AD resources without user interaction) with OAuth 2.0 flows that require interactive consent, or they overcomplicate the solution by choosing a custom connector when the built-in 'HTTP' action already supports the authorization code grant natively.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use the 'HTTP' action with 'OAuth 2.0' authentication and configure the authorization endpoint, client ID, and client secret.
The 'HTTP' action with 'OAuth 2.0' authentication type in Azure Logic Apps is specifically designed to handle the authorization code grant flow, including interactive user consent. It manages the token lifecycle (acquisition, refresh, and storage) automatically, minimizing development effort. You only need to configure the authorization endpoint, client ID, and client secret, and the runtime handles the redirect and token exchange.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Use the 'HTTP' action with 'OAuth 2.0' authentication and configure the authorization endpoint, client ID, and client secret.
Why this is correct
The 'HTTP' action in Azure Logic Apps is highly versatile and directly supports the OAuth 2.0 authorization code grant flow. By configuring the authorization endpoint, client ID, and client secret, the Logic App can initiate the OAuth flow, handle user consent, and acquire an access token to authenticate requests to the external API. This built-in capability minimizes development effort for integrating with standard OAuth 2.0 protected services.
- ✗
Use the 'HTTP + Swagger' action with 'Identity Provider' authentication.
Why it's wrong here
The 'HTTP + Swagger' action is primarily designed to consume APIs defined by an OpenAPI (Swagger) specification, providing strongly typed actions based on the API's schema. While it can support various authentication types, 'Identity Provider' authentication is a broad term and does not specifically enable the interactive OAuth 2.0 flow required for user consent with an external API. Its focus is on API definition integration rather than a specific interactive authentication mechanism.
- ✗
Use the 'API Connection' action with a custom connector that uses OAuth 2.0.
Why it's wrong here
Custom connectors require manual configuration of the OAuth 2.0 flow, which increases development effort compared to using built-in HTTP actions with Microsoft Entra ID authentication. This approach is appropriate when you must define specific OpenAPI definitions or custom authentication parameters for non-standard APIs, but it fails to meet the requirement to minimise development work for an existing external API.
- ✗
Use the 'HTTP' action with 'Managed identity' authentication.
Why it's wrong here
Managed identities provide an Azure-native mechanism for Azure resources to authenticate to other Azure AD-protected resources without managing credentials. They are inherently non-interactive and designed for service-to-service authentication within the Azure ecosystem. Consequently, managed identities cannot facilitate an OAuth 2.0 authorization code grant flow that requires user interaction or consent with an external API, making them unsuitable for this scenario.
Go deeper
Related to this question
About these practice questions
This AZ-204 question is part of Courseiva's 881-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.