AZ-204 Implement Azure security Practice Question
You are building an API that needs to validate JWT tokens issued by Microsoft Entra ID. The API is registered as an application in Entra ID. Which endpoint should the API use to obtain the signing keys?
⚠ Common exam trap
Watch out — candidates often confuse the OpenID Connect metadata endpoint (Option C) with the actual key endpoint, not realizing that the metadata only provides a URL to the keys, and the exam expects you to know the specific `/discovery/v2.0/keys` endpoint for direct key retrieval.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
https://login.microsoftonline.com/{tenant}/discovery/v2.0/keys
The endpoint `https://login.microsoftonline.com/{tenant}/discovery/v2.0/keys` is the Microsoft Entra ID (formerly Azure AD) v2.0 JWKS (JSON Web Key Set) URI, which returns the public signing keys used to validate the signature of JWT tokens. The API must fetch these keys to verify the token's integrity and authenticity, as the keys are rotated periodically.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
https://login.microsoftonline.com/{tenant}/oauth2/v2.0/token
Why it's wrong here
This endpoint is specifically designed for client applications to acquire tokens, such as access tokens, refresh tokens, and ID tokens, by exchanging an authorization grant. It is part of the OAuth 2.0 flow for obtaining credentials after a user has authenticated and authorized an application. While crucial for token issuance, it does not provide the public cryptographic keys necessary for an API to validate the signature of a received JWT.
- ✗
https://login.microsoftonline.com/{tenant}/oauth2/v2.0/authorize
Why it's wrong here
The authorize endpoint is used to initiate the OAuth 2.0 authorization flow, typically by redirecting a user's browser to the identity provider for authentication and consent. Its primary function is to obtain user consent and return an authorization code to the client application. This endpoint is solely focused on the initial authorization step and plays no role in providing the public keys required for an API to verify the authenticity and integrity of a JWT.
- ✗
https://login.microsoftonline.com/{tenant}/v2.0/.well-known/openid-configuration
Why it's wrong here
This OpenID Connect discovery endpoint provides a JSON document containing various metadata about the identity provider, including the URIs for authorization, token, and userinfo endpoints. Crucially, it includes the `jwks_uri` property, which is a URL pointing to the actual endpoint where the JSON Web Key Set (JWKS) containing the public keys resides. While essential for dynamically discovering the JWKS endpoint, it does not directly return the public keys themselves.
- ✓
https://login.microsoftonline.com/{tenant}/discovery/v2.0/keys
Why this is correct
This endpoint, often referred to as the JSON Web Key Set (JWKS) endpoint, directly returns a set of public cryptographic keys in JSON Web Key (JWK) format. These public keys are precisely what an API needs to cryptographically verify the signature of a received JWT. By using these keys, the API can confirm that the token was issued by the trusted identity provider and has not been tampered with, ensuring its authenticity and integrity.
Go deeper
Related to this question
About these practice questions
Courseiva writes every AZ-204 question from scratch — 881 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.