Configuring App Service Authentication with Client ID, Issuer URL, and Allowed Audiences
You deploy a web application in Azure App Service. You need to authenticate users via Microsoft Entra ID (Microsoft Entra ID) with minimal custom code. Which App Service feature should you configure?
⚠ Common exam trap
It's easy for candidates to confuse Managed Identity (which is for server-to-server resource access) with user authentication, or they overcomplicate the solution by choosing B2C when the requirement is simply to authenticate against an existing Microsoft Entra ID tenant with minimal code.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
App Service Authentication (Easy Auth)
App Service Authentication (also known as Easy Auth) is the correct choice because it provides a turnkey authentication layer that integrates directly with Microsoft Entra ID. It requires minimal custom code by handling the OAuth 2.0 authorization code flow, token validation, and session management at the App Service platform level, allowing you to simply configure the identity provider in the Azure portal.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
App Service Authentication (Easy Auth)
Why this is correct
App Service Authentication, often called Easy Auth, provides a built-in, declarative way to secure your web application by offloading user authentication to the App Service platform. It integrates seamlessly with identity providers like Microsoft Entra ID, allowing your application to authenticate enterprise users without writing any authentication-related code. This significantly reduces development effort and enhances security by centralizing identity management at the platform level.
- ✗
Microsoft Entra ID B2C
Why it's wrong here
Microsoft Entra ID B2C is designed for customer-facing identity management with social and local account sign-ups, not for authenticating enterprise users against an existing organisational tenant. The stem requires minimal custom code for workforce authentication, which the built-in Microsoft Entra ID authentication provider in App Service handles directly. It is tempting because B2C also integrates with Microsoft Entra ID, but its purpose is external customer identity, not internal employee access.
- ✗
Application Gateway with WAF
Why it's wrong here
Azure Application Gateway functions as a Layer 7 load balancer and traffic manager, directing web traffic to your backend services. While its Web Application Firewall (WAF) component protects against common web vulnerabilities like SQL injection and cross-site scripting, it does not handle user authentication. Application Gateway operates at the network edge, securing and routing requests, but it does not verify user identities or issue authentication tokens for your application.
- ✗
App Service Managed Identity
Why it's wrong here
App Service Managed Identity provides an automatically managed identity for your Azure App Service instance, enabling it to authenticate securely to other Azure services without needing to store credentials in your code or configuration. This identity is used by the *application itself* to access resources like Azure Key Vault, Storage Accounts, or SQL databases. It is not designed for authenticating *end-users* who are trying to access your web application.
Go deeper
Related to this question
About these practice questions
Courseiva writes every AZ-204 question from scratch — 883 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on AZ-204
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Your application uses Azure App Service and needs to authenticate users via Microsoft Entra ID. You want to minimize code changes. Which feature should you use?
easy- A.Azure AD B2C
- B.Microsoft.Identity.Web library
- ✓ C.App Service Authentication (Easy Auth)
- D.MSAL.js
Why C: App Service Authentication (also known as Easy Auth) is the correct choice because it enables authentication with Microsoft Entra ID (formerly Azure AD) at the platform level, requiring no code changes in your application. It automatically handles token validation, session management, and redirects by intercepting HTTP requests before they reach your app code, which directly satisfies the requirement to minimize code changes.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.