AZ-204 Implement Azure security Practice Question
You are developing a web API that must authenticate requests using Microsoft Entra ID (Microsoft Entra ID) and OAuth 2.0 bearer tokens. You want to validate the token in your API code. Which library should you use?
⚠ Common exam trap
Candidates often confuse token acquisition libraries (MSAL, Azure.Identity) with token validation libraries, leading them to pick MSAL because it is commonly associated with Entra ID authentication, even though it does not validate bearer tokens in an API.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft.Identity.Web
Microsoft.Identity.Web is the recommended library for integrating ASP.NET Core web APIs with Microsoft Entra ID. It provides built-in token validation, policy enforcement, and handles the OAuth 2.0 bearer token flow, including JWT validation, issuer signing keys, and audience checks, without requiring manual configuration of middleware.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Microsoft Authentication Library (MSAL)
Why it's wrong here
MSAL (Microsoft Authentication Library) is specifically designed for client applications, such as web, mobile, or desktop apps, to interact with the Microsoft identity platform to acquire security tokens. Its primary function is to manage user authentication flows, token caching, and refresh operations on the client side. A web API, conversely, requires a server-side mechanism or middleware to validate the authenticity, integrity, and authorization claims of incoming bearer tokens presented by these clients, which is a fundamentally different responsibility from token acquisition.
- ✓
Microsoft.Identity.Web
Why this is correct
Microsoft.Identity.Web is the recommended and most current library for integrating Microsoft identity platform authentication and authorization into ASP.NET Core web APIs and web applications. It provides a comprehensive set of middleware and helper classes that significantly simplify the process of validating incoming bearer tokens issued by Microsoft Entra ID. This includes automatically handling token signature verification, issuer and audience validation, lifetime checks, and extracting claims, thereby ensuring robust security for API endpoints.
- ✗
ADAL.NET
Why it's wrong here
ADAL.NET (Azure Active Directory Authentication Library for .NET) is an older, deprecated library that should not be used for new development. While it previously facilitated authentication with Azure Active Directory, it does not support the latest security protocols, modern token formats (like those required for Microsoft Graph), or current authentication flows. Utilizing ADAL.NET in new projects would introduce security vulnerabilities, lack support for contemporary identity features, and prevent access to ongoing improvements in the Microsoft identity platform.
- ✗
Azure.Identity
Why it's wrong here
The Azure.Identity library provides credential types for authenticating applications to various Azure services, such as Azure Key Vault, Azure Storage, or Azure Cosmos DB. Its purpose is to simplify credential management and offer a unified authentication experience for accessing *Azure resources* from within an application using managed identities, service principals, or developer credentials. It is not designed for the server-side validation of incoming bearer tokens presented by client applications to a custom web API, which requires specialized token validation middleware.
Go deeper
Related to this question
About these practice questions
One of 881 original AZ-204 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.