Implement Azure security →hardMultiple ChoiceObjective-mapped

AZ-204 Implement Azure security Practice Question

You are developing a web API hosted on Azure App Service. The API must authenticate requests using Microsoft Entra ID OAuth 2.0 bearer tokens. You want to validate the token in your ASP.NET Core API code with minimal custom validation logic. Which library should you use?

⚠ Common exam trap

Watch out — candidates often confuse MSAL (for token acquisition) with Microsoft.Identity.Web (for token validation), or assume the Azure Identity library handles all authentication scenarios, when it is actually focused on service-to-service authentication and Azure SDK credentials.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Microsoft.Identity.Web

Microsoft.Identity.Web is the correct choice because it provides a high-level, opinionated library that integrates directly with ASP.NET Core's authentication pipeline, handling token validation, scopes, and app roles with minimal custom code. It abstracts away the complexity of JWT bearer token validation against Microsoft Entra ID, including automatic OpenID Connect discovery and token signature verification.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Microsoft Authentication Library (MSAL)
Why it's wrong here
The Microsoft Authentication Library (MSAL) is a client-side library designed for applications (e.g., web, mobile, desktop) to acquire security tokens from Microsoft Entra ID. Its primary function is to facilitate the authentication flow for users and applications to *obtain* access tokens, which are then sent to a protected API. MSAL does not provide functionality for a web API to *validate* these incoming tokens; that is a server-side responsibility.
✗
Azure Identity client library
Why it's wrong here
The Azure Identity client library provides a unified authentication experience for applications to access *Azure services* (e.g., Key Vault, Storage, Cosmos DB) using various credential types, including managed identities or service principals. Its purpose is to secure communication *from* your application *to* Azure resources, streamlining credential management. It is not designed for validating incoming bearer tokens presented by client applications to your own custom web API.
✓
Microsoft.Identity.Web
Why this is correct
Microsoft.Identity.Web is an ASP.NET Core library specifically engineered to simplify the integration of web APIs and web applications with Microsoft Entra ID. It provides out-of-the-box middleware and services for validating incoming bearer tokens, handling claims transformation, and enforcing authorization policies based on scopes and roles. This library significantly reduces the boilerplate code required for secure API development by abstracting away the complexities of OpenID Connect token validation.
✗
Azure Management Libraries for .NET
Why it's wrong here
The Azure Management Libraries for .NET are a set of client libraries that enable developers to programmatically interact with and manage Azure resources via the Azure Resource Manager API. These libraries are used for tasks such as creating, updating, and deleting virtual machines, storage accounts, or App Services from within an application. They are entirely distinct from identity and access management within a web API, focusing on infrastructure management rather than API token validation.

Go deeper

AZ-204 Implement Azure security Practice Question

Why each option matters

Option-by-option breakdown

Related to this question