AZ-204 Implement Azure security Practice Question
You are developing an ASP.NET Core web API that authenticates users via Microsoft Entra ID. The application needs to authorize access to resources based on custom roles (e.g., 'Admin', 'Editor') that are not present in Microsoft Entra ID. The role mappings are dynamic and stored in an application database. How should you implement authorization?
⚠ Common exam trap
Candidates often assume custom roles must be embedded in the token via claims, overlooking that dynamic roles from a database can be evaluated post-authentication using a custom authorization policy.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Store the role mappings in an Azure SQL Database and use a custom authorization policy that queries the database after authentication.
The custom roles are dynamic and stored in an application database, not in Microsoft Entra ID. After authentication, a custom authorization policy can query the database to retrieve the role mappings for the authenticated user and enforce access control. This approach decouples role management from the identity provider and supports dynamic role assignments.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Define the roles as Microsoft Entra ID app roles and include them in the token claims.
Why it's wrong here
Microsoft Entra ID app roles are defined statically within an application's manifest. While they can be included in token claims, modifying these roles or assigning them dynamically based on data from an external database requires updating the application registration, which is not scalable or efficient for frequently changing role assignments. This approach lacks the flexibility needed for dynamic role management where mappings are stored and managed in a database.
- ✓
Store the role mappings in an Azure SQL Database and use a custom authorization policy that queries the database after authentication.
Why this is correct
This is the most flexible and scalable solution for dynamic role management. After a user is authenticated by Microsoft Entra ID, a custom authorization handler, part of an ASP.NET Core policy, can query the Azure SQL Database to retrieve the user's current role assignments. This approach ensures that authorization decisions are always based on the most up-to-date role data from the database, without requiring token re-issuance or application manifest changes for role updates.
- ✗
Include the roles as claims in the Microsoft Entra ID token by using a custom claim mapping policy.
Why it's wrong here
While Microsoft Entra ID allows for custom claim mapping policies, these policies primarily operate on attributes and roles defined within Microsoft Entra ID itself. They cannot directly query an external Azure SQL Database to fetch dynamic role assignments and inject them into the token claims. Implementing this would necessitate complex synchronization mechanisms to push database roles into Entra ID, which is inefficient and introduces latency and potential inconsistencies.
- ✗
Store the role mappings in the web.config file and read them at runtime.
Why it's wrong here
Storing role mappings in the web.config file is highly unsuitable for dynamic role management. The web.config file is static and part of the application deployment package; any changes to role assignments would necessitate modifying the file and redeploying the entire application, which is impractical. Furthermore, it is not a secure location for sensitive authorization data and lacks the robust management capabilities of a database.
Go deeper
Related to this question
About these practice questions
Courseiva writes every AZ-204 question from scratch — 881 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.