Connect to and consume Azure services and third-party services →mediumMultiple ChoiceObjective-mapped
AZ-204 Practice Question: Connect to and consume Azure services and third-party services
You are developing a .NET Core application that needs to authenticate users via Microsoft Entra ID and call Microsoft Graph API. You register an app in the Microsoft Entra admin center and configure the necessary permissions. However, when the app tries to acquire a token, it receives an 'interaction_required' error. What is the most likely cause?
⚠ Common exam trap
Many exam-takers confuse 'interaction_required' with authentication failures like invalid credentials or misconfigured URIs, but the error specifically indicates a consent or policy-driven interaction need, not a configuration mismatch.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The application is requesting admin-restricted permissions without admin consent.
The 'interaction_required' error occurs when the application requests permissions that require admin consent, but the user is not an admin or admin consent has not been granted. In Microsoft Entra ID, certain Graph API permissions (e.g., User.Read.All, Mail.Read) are marked as admin-restricted and require an admin to consent via the admin consent endpoint. Without this consent, the token acquisition fails with this specific error.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The client secret is expired or invalid.
Why it's wrong here
An expired or invalid client secret prevents the application from successfully authenticating itself with Azure AD. This typically results in an `invalid_client` or `unauthorized_client` error during the token acquisition phase, as the identity provider cannot validate the calling application. It does not trigger an `interaction_required` error, which signifies a need for user intervention like consent or MFA, but rather a fundamental failure in application authentication.
- ✗
The scope parameter is incorrectly formatted.
Why it's wrong here
An incorrectly formatted scope parameter, such as a malformed resource URI or an unrecognized permission name, will cause Azure AD to return an `invalid_scope` error. This error indicates that the requested permissions are not understood or are invalid according to the identity provider's schema. It prevents the token issuance entirely and does not prompt for user interaction, as the issue lies with the request's structure, not a pending user action.
- ✓
The application is requesting admin-restricted permissions without admin consent.
Why this is correct
When an application requests permissions that are designated as admin-restricted (e.g., certain high-privilege Microsoft Graph API permissions) and an administrator has not yet granted tenant-wide consent for these permissions, Azure AD will return an `interaction_required` error. This error explicitly signals that an administrator must intervene to review and approve the elevated permissions before the application can successfully acquire a token. User interaction is necessary to resolve the outstanding administrative consent.
- ✗
The redirect URI does not match the registered redirect URI.
Why it's wrong here
A mismatch between the redirect URI provided in the authorization request and the redirect URIs registered for the application in Azure AD is a critical security validation failure. This discrepancy typically results in an `invalid_redirect_uri` error, preventing the authorization flow from completing and ensuring that tokens are not sent to an unauthorized endpoint. This is a hard stop error that blocks the flow, rather than prompting for user interaction to resolve a pending action.
Go deeper
Related to this question
About these practice questions
Courseiva writes every AZ-204 question from scratch — 881 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.