AZ-204 Develop Azure compute solutions Practice Question
You are building a serverless API using Azure Functions with an HTTP trigger. The API must authenticate requests using Microsoft Entra ID (formerly Azure AD). You need to validate the token in the function code. Which component should you use?
⚠ Common exam trap
Many exam-takers confuse MSAL (for token acquisition) with token validation libraries, or assume that host-level Easy Auth (Option A) is equivalent to in-code validation, when the question explicitly requires validation within the function code.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use the Microsoft.Identity.Web library to validate the token.
Microsoft.Identity.Web is the recommended library for integrating Azure Functions with Microsoft Entra ID. It provides built-in token validation, including signature verification, issuer validation, and audience checking, by leveraging the same middleware used in ASP.NET Core. This library simplifies the process of validating JWT tokens issued by Microsoft Entra ID without requiring manual token parsing or validation logic.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Configure the Azure Functions host to use Microsoft Entra ID authentication.
Why it's wrong here
This is an alternative, not in-code validation as specified.
- ✗
Use the Microsoft Authentication Library (MSAL) to validate the token.
Why it's wrong here
MSAL is for acquiring tokens, not validating them.
- ✓
Use the Microsoft.Identity.Web library to validate the token.
Why this is correct
Microsoft.Identity.Web provides token validation for Microsoft Entra ID tokens.
- ✗
Use Azure AD B2C to validate the token.
Why it's wrong here
Azure AD B2C is for customer identities, not general Entra ID validation.
Quick reference
Cloud Service Model Comparison
| Model | You Manage | Provider Manages | Examples |
|---|---|---|---|
| IaaS | OS, runtime, apps, data | Hardware, hypervisor, networking | EC2, Azure VMs, GCP Compute Engine |
| PaaS | Apps and data | OS, runtime, middleware, hardware | Elastic Beanstalk, Azure App Service |
| SaaS | Data and settings only | Everything else | Microsoft 365, Salesforce, Workday |
| FaaS / Serverless | Function code only | Infra, scaling, runtime | Lambda, Azure Functions, Cloud Run |
| CaaS | Containers and apps | Kubernetes, OS, hardware | EKS, AKS, GKE |
Go deeper
Related to this question
Learn chapter
Azure Functions Development
Key term
Azure Functions Bindings
Azure Functions Bindings are declarative connections that link your serverless function code to Azure services or external resources, handling input and output data automatically without writing extra networking or authentication code.
Key term
Durable Functions
Durable Functions is an extension of Azure Functions that lets you write stateful workflows in code, managing complex sequences of tasks, retries, and delays automatically.
About these practice questions
Courseiva writes every AZ-204 question from scratch — 881 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.