AZ-204 Implement Azure security Practice Question
You are developing a web app that authenticates users via Microsoft Entra ID. The app needs to read the user's profile and send emails on their behalf. You want to minimize user consent prompts. Which OAuth 2.0 grant type should you use?
⚠ Common exam trap
Candidates often choose the client credentials flow (B) thinking it minimizes prompts because it doesn't involve user interaction, but they overlook that the app needs to act on behalf of a specific user, which requires delegated permissions and user consent, not application permissions.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Authorization code flow with PKCE
The authorization code flow with PKCE (Proof Key for Code Exchange) is the recommended OAuth 2.0 grant type for public clients (like a web app) that need delegated user authentication and consent. It allows the app to obtain an access token to read the user's profile and a refresh token to send emails on their behalf, while minimizing consent prompts by using a single consent request for both permissions. PKCE adds a cryptographic challenge to prevent authorization code interception attacks, making it secure for web apps without a client secret.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Authorization code flow with PKCE
Why this is correct
This is the recommended and most secure OAuth 2.0 flow for web applications authenticating users. It involves redirecting the user's browser to the identity provider for authentication, then receiving an authorization code back at a registered redirect URI. This code is then securely exchanged for access and refresh tokens from the backend, preventing tokens from being exposed in the browser's URL. PKCE (Proof Key for Code Exchange) further enhances security by mitigating authorization code interception attacks, particularly important for public clients but also a strong best practice for confidential web apps.
- ✗
Client credentials flow
Why it's wrong here
The client credentials flow is designed for server-to-server or machine-to-machine communication where an application needs to access resources on its own behalf, without a user context. It authenticates the application itself using its client ID and client secret, granting permissions directly to the application. Since this flow does not involve a user and cannot obtain delegated permissions to act on a user's behalf, it is entirely unsuitable for authenticating individual users within a web application.
- ✗
Resource owner password credentials
Why it's wrong here
This flow is highly insecure and has been deprecated by the OAuth 2.0 Security Best Current Practice. It requires the user to directly provide their username and password to the application, which then sends these credentials to the identity provider. This practice exposes user credentials to the application, making it vulnerable to phishing and credential compromise, and prevents the use of multi-factor authentication. It violates the fundamental security principle of never trusting the client with user credentials.
- ✗
Implicit flow
Why it's wrong here
The implicit flow, primarily used by single-page applications (SPAs) in the past, is now deprecated due to significant security concerns. It directly returns access tokens in the URL fragment after user authentication, making them susceptible to leakage via browser history, referrer headers, or malicious scripts. Furthermore, this flow does not support refresh tokens, meaning applications must frequently prompt the user for re-authentication or rely on short-lived access tokens, leading to a poor user experience.
Go deeper
Related to this question
About these practice questions
Courseiva writes every AZ-204 question from scratch — 881 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.