Implement Azure security →easyMultiple ChoiceObjective-mapped

AZ-204 Implement Azure security Practice Question

You are developing an ASP.NET Core web app that will be deployed to Azure App Service. The app needs to authenticate users from a Microsoft Entra ID tenant. You want to minimize development effort and rely on platform features. What should you do?

⚠ Common exam trap

The trap here is that candidates often overestimate the need for code-based solutions (like Microsoft.Identity.Web) and underestimate the power of Azure's built-in App Service Authentication, which can handle the entire authentication flow with zero code changes in the app.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Enable App Service Authentication in the Azure portal and configure Microsoft Entra ID as the identity provider.

Enabling App Service Authentication (also known as EasyAuth) in the Azure portal allows you to configure Microsoft Entra ID as the identity provider with minimal code changes. This approach leverages the platform's built-in authentication layer, which automatically handles token validation, session management, and redirects, thereby reducing development effort and relying on Azure's managed features.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Implement custom OAuth 2.0 middleware in the app.
Why it's wrong here
Implementing custom OAuth 2.0 middleware directly within the ASP.NET Core application is a complex and error-prone approach for authentication. It requires deep knowledge of OAuth 2.0 flows, token validation, and secure credential handling, significantly increasing development and maintenance overhead. Azure App Service Authentication (EasyAuth) provides a fully managed, secure, and robust alternative, abstracting away the complexities of integrating identity providers.
✗
Add Microsoft.Identity.Web NuGet package and configure it in Startup.cs to use Microsoft Entra ID.
Why it's wrong here
Integrating the Microsoft.Identity.Web NuGet package into the ASP.NET Core application is a standard and effective way to handle authentication with Microsoft Entra ID. However, this method necessitates direct code modifications in Startup.cs and controller actions, requiring developers to manage the authentication pipeline within the application itself. For scenarios prioritizing zero code changes for authentication, Azure App Service Authentication offers a simpler, platform-managed solution that operates at the gateway level.
✗
Use Microsoft Entra ID App Roles and add role checks in the code.
Why it's wrong here
Microsoft Entra ID App Roles are designed for authorization, defining specific permissions and access levels within an application, not for the initial process of user authentication. While App Roles are crucial for controlling what an authenticated user can do, they do not establish who the user is. Implementing role checks in code presumes a user has already been authenticated, which is a separate concern addressed by an authentication mechanism.
✓
Enable App Service Authentication in the Azure portal and configure Microsoft Entra ID as the identity provider.
Why this is correct
Enabling App Service Authentication, often referred to as EasyAuth, in the Azure portal provides a fully managed authentication solution that operates at the gateway level, external to the application code. By configuring Microsoft Entra ID as the identity provider, Azure App Service handles the entire authentication flow, including redirecting unauthenticated requests, validating tokens, and injecting user claims into HTTP headers. This approach requires no modifications to the application's codebase, significantly simplifying development and deployment.

Go deeper

AZ-204 Implement Azure security Practice Question

Why each option matters

Option-by-option breakdown

Related to this question