AZ-204 Practice Question: Connect to and consume Azure services and third-party services

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  HTTP action with Active Directory OAuth authentication

  Why this is correct

  The HTTP action in Azure Logic Apps provides robust, built-in support for various authentication types, including Active Directory OAuth. When configured, it handles the entire client credentials flow by using an Azure AD application registration's client ID and secret to acquire an access token from Microsoft Entra ID. This token is then automatically included in the Authorization header of the outgoing request to the external API, ensuring secure and compliant authentication without manual token management.

• ✗

  HTTP action with Managed Identity authentication

  Why it's wrong here

  Managed Identities are designed to provide Azure resources with an identity in Microsoft Entra ID, enabling them to authenticate to *other Azure services* that support Azure AD authentication, such as Azure Key Vault or Azure Storage. They are not intended for authenticating to generic *external APIs* that are not part of the Azure ecosystem and do not inherently understand or validate Managed Identity tokens. Consequently, an external API expecting a standard OAuth token from a specific app registration would reject a request authenticated via a Managed Identity.

• ✗

  Invoke the API through Azure API Management

  Why it's wrong here

  While technically possible to route API calls through Azure API Management, this approach introduces an unnecessary layer of complexity, additional cost, and latency for the sole purpose of calling an external API. API Management acts as a proxy and would still require its own configuration to handle the OAuth client credentials flow to the backend API, effectively shifting the authentication challenge rather than directly solving it within the Logic App's context. It does not simplify the core requirement of obtaining and managing an OAuth token.

• ✗

  Use the Microsoft Entra ID OAuth 2.0 connector

  Why it's wrong here

  There is no dedicated, standard 'Microsoft Entra ID OAuth 2.0 connector' within Azure Logic Apps specifically designed for calling external APIs that require OAuth 2.0 authentication. Logic Apps instead provides the highly flexible HTTP action, which includes comprehensive, built-in authentication settings to directly configure various OAuth 2.0 grant types, including client credentials, for seamless integration with external services. Relying on the HTTP action's native capabilities is the intended and most efficient method.

Go deeper

Related to this question