Connect to and consume Azure services and third-party services →mediumMultiple ChoiceObjective-mapped
AZ-204 Practice Question: Connect to and consume Azure services and third-party services
Tailwind Traders uses Azure Logic Apps to orchestrate a multi-step business process. The workflow must call an external REST API that requires OAuth 2.0 authentication. The API is registered in Microsoft Entra ID. The Logic App must authenticate using a system-assigned managed identity. The API's app registration has been configured to accept tokens from the managed identity. Which connector should the team use in the Logic App to call the API, and how should they configure authentication?
⚠ Common exam trap
Candidates often confuse 'Active Directory OAuth' with managed identity authentication, or assume a custom connector is necessary for custom APIs, when the HTTP connector with 'Managed Identity' is the simplest and most secure option for this scenario.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use the HTTP connector. In the connector's authentication settings, choose 'Managed Identity' and select the system-assigned identity. Set the audience to the API's Application ID URI.
The HTTP connector with 'Managed Identity' authentication is the correct choice because the Logic App needs to call an external REST API that accepts tokens from a system-assigned managed identity. By selecting 'Managed Identity' and setting the audience to the API's Application ID URI, the Logic App automatically acquires an access token from Microsoft Entra ID using the system-assigned identity, without needing to manage credentials. This aligns with the requirement for OAuth 2.0 authentication using a managed identity.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Use the HTTP connector. In the connector's authentication settings, choose 'Managed Identity' and select the system-assigned identity. Set the audience to the API's Application ID URI.
Why this is correct
The HTTP connector in Azure Logic Apps is the appropriate choice for invoking external HTTP endpoints. By selecting 'Managed Identity' authentication and choosing the system-assigned identity, the Logic App securely obtains an Azure AD access token without requiring any stored credentials. The 'Audience' parameter, set to the API's Application ID URI, is crucial as it specifies the intended recipient of the token, ensuring the token is valid for authenticating against that specific API. This method aligns with Azure's security best practices for service-to-service authentication.
- ✗
Use the HTTP connector with 'Active Directory OAuth' authentication. Provide the client ID and client secret of a service principal.
Why it's wrong here
While using 'Active Directory OAuth' with a service principal's client ID and client secret would technically allow the Logic App to authenticate, this approach requires managing and securely storing a secret. Managed Identities are designed to eliminate the need for developers to manage credentials directly, offering a more secure and operationally simpler alternative. Therefore, this option introduces unnecessary credential management overhead compared to leveraging a managed identity.
- ✗
Use the custom connector. In the custom connector's authentication, choose 'Managed Identity' and provide the managed identity's principal ID.
Why it's wrong here
A custom connector is typically developed when an existing Azure Logic Apps connector does not support the specific API or authentication method required, or when complex data transformations are needed. For a standard HTTP endpoint protected by Azure AD, the built-in HTTP connector provides direct support for managed identity authentication, making a custom connector an over-engineered and more complex solution. Furthermore, the principal ID is usually an internal identifier, not directly configured as an authentication parameter in this manner.
- ✗
Use the Azure API Management connector. Configure it to use OAuth 2.0 with the managed identity.
Why it's wrong here
Azure API Management (APIM) is a robust solution for publishing, securing, and managing APIs, often used for exposing backend services to external consumers or for applying policies like throttling and caching. However, if the Logic App simply needs to directly call an internal API that is already secured and accessible, introducing APIM as an intermediary adds unnecessary complexity, latency, and cost. The direct HTTP connector is sufficient and more efficient for this straightforward integration scenario.
Go deeper
Related to this question
Learn chapter
Azure Functions Development
Key term
Key Vault Secrets
Key Vault Secrets are secure containers in Microsoft Azure that store sensitive information like passwords, connection strings, and API keys, keeping them encrypted and accessible only to authorized applications and users.
Key term
Managed identity
A managed identity is an automatically managed service principal in Azure that allows your code to authenticate to any service that supports Azure AD authentication without storing credentials.
About these practice questions
One of 881 original AZ-204 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.