Configuring App Service Authentication with Client ID, Issuer URL, and Allowed Audiences
Your application uses Azure App Service and needs to authenticate users via Microsoft Entra ID. Which THREE components must be configured in the App Service authentication settings?
Quick Answer
The answer is the Client ID, Issuer URL, and Allowed Token Audiences. The Client ID uniquely identifies your application registration to Microsoft Entra ID, while the Issuer URL tells App Service where to fetch and validate the signing keys for incoming tokens. The Allowed Token Audiences ensure that the token was issued specifically for your app, preventing token replay across different applications. On the AZ-204 exam, this tests your understanding of the App Service Authentication configuration components as a three-part trust relationship between the app, the identity provider, and the token itself. A common trap is confusing the Client Secret (optional for implicit flows) or the Tenant ID (which is already embedded in the Issuer URL) as required fields. Remember the memory tip: “ID, URL, Audience” — the app’s identity, the issuer’s location, and the token’s intended recipient.
⚠ Common exam trap
Many candidates confuse the required fields for App Service authentication with those needed for a manual OAuth 2.0 implementation, mistakenly adding the Client secret or Tenant ID as separate required fields when they are either optional or derived from the Issuer URL.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Client ID
The Client ID uniquely identifies your application registration in Microsoft Entra ID. App Service uses this ID to initiate the OAuth 2.0 authorization code flow, ensuring that tokens are issued specifically to your app. Without it, the authentication middleware cannot associate incoming tokens with your registered application.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Client ID
Why this is correct
Required to identify the application.
- ✓
Allowed token audiences
Why this is correct
Ensures the token is intended for this app.
- ✓
Issuer URL
Why this is correct
Required to validate token issuer.
- ✗
Client secret
Why it's wrong here
Not required if using client credentials flow or other methods.
- ✗
Tenant ID
Why it's wrong here
Tenant ID is part of the issuer URL.
Go deeper
Related to this question
About these practice questions
This AZ-204 question is part of Courseiva's 881-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on AZ-204
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. You deploy a web application in Azure App Service. You need to authenticate users via Microsoft Entra ID (Microsoft Entra ID) with minimal custom code. Which App Service feature should you configure?
medium- ✓ A.App Service Authentication (Easy Auth)
- B.Microsoft Entra ID B2C
- C.Application Gateway with WAF
- D.App Service Managed Identity
Why A: App Service Authentication (also known as Easy Auth) is the correct choice because it provides a turnkey authentication layer that integrates directly with Microsoft Entra ID. It requires minimal custom code by handling the OAuth 2.0 authorization code flow, token validation, and session management at the App Service platform level, allowing you to simply configure the identity provider in the Azure portal.
Variation 2. Your application uses Azure App Service and needs to authenticate users via Microsoft Entra ID. You want to minimize code changes. Which feature should you use?
easy- A.Azure AD B2C
- B.Microsoft.Identity.Web library
- ✓ C.App Service Authentication (Easy Auth)
- D.MSAL.js
Why C: App Service Authentication (also known as Easy Auth) is the correct choice because it enables authentication with Microsoft Entra ID (formerly Azure AD) at the platform level, requiring no code changes in your application. It automatically handles token validation, session management, and redirects by intercepting HTTP requests before they reach your app code, which directly satisfies the requirement to minimize code changes.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.