AZ-204 Implement Azure security Practice Question
You are designing a solution where an Azure Logic App needs to send emails via Microsoft Graph. The Logic App should authenticate without user interaction. What authentication method should you use?
⚠ Common exam trap
Many exam-takers confuse delegated permissions (which require a signed-in user) with application permissions (which allow daemon/service scenarios), and mistakenly choose OAuth authorization code grant or service principal with secret, not realizing managed identities are the recommended zero-secret approach for Azure resources.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use a user-assigned managed identity and grant it the Mail.Send application permission
A user-assigned managed identity provides a secure, passwordless authentication method for Azure resources. By granting it the Mail.Send application permission (not delegated), the Logic App can authenticate to Microsoft Graph without any user interaction, as managed identities are automatically managed by Azure and do not require credential rotation or storage.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Use a user-assigned managed identity and grant it the Mail.Send application permission
Why this is correct
User-assigned managed identities provide an Azure AD identity for Azure resources, eliminating the need for developers to manage credentials. By granting the Mail.Send application permission to this managed identity, the Logic App can securely authenticate with Microsoft Graph and send emails programmatically without any user interaction or storing secrets. This approach adheres to the principle of least privilege and enhances security by leveraging Azure AD for authentication and authorization.
- ✗
Use OAuth 2.0 authorization code grant with a user account
Why it's wrong here
The OAuth 2.0 authorization code grant flow is designed for applications that require user interaction to consent to permissions, typically involving a browser redirect for the user to sign in and authorize. For an automated Azure Logic App, which operates without a human user present to interact with a sign-in prompt, this flow is entirely unsuitable. It would prevent the Logic App from ever obtaining the necessary access token to send mail autonomously.
- ✗
Use a service principal and store its client secret in the Logic App configuration
Why it's wrong here
While a service principal can represent an application identity in Azure AD, storing its client secret directly within the Logic App's configuration settings introduces significant security risks. These secrets would need to be manually managed, rotated, and secured against unauthorized access, increasing the operational overhead and potential for compromise. Managed identities offer a superior, credential-less authentication mechanism, making this approach less secure and more cumbersome.
- ✗
Use basic authentication with an email account password
Why it's wrong here
Basic authentication, which involves sending a username and password with every request, is considered highly insecure and is largely deprecated by modern services, including Microsoft 365 for email. This method transmits credentials in a way that is vulnerable to interception and replay attacks, especially if not strictly enforced over HTTPS. Relying on basic authentication would expose the email account's password, posing a significant security risk and likely failing to connect to modern email services.
Go deeper
Related to this question
Learn chapter
Azure Functions Development
Key term
Managed identity
A managed identity is an automatically managed service principal in Azure that allows your code to authenticate to any service that supports Azure AD authentication without storing credentials.
Key term
Key Vault Secrets
Key Vault Secrets are secure containers in Microsoft Azure that store sensitive information like passwords, connection strings, and API keys, keeping them encrypted and accessible only to authorized applications and users.
About these practice questions
This AZ-204 question is part of Courseiva's 881-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.