AZ-204 Implement Azure security Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  https://{function-app}.azurewebsites.net/.auth/login

  Why it's wrong here

  This endpoint is part of Azure App Service Authentication/Authorization, commonly known as Easy Auth. Its primary purpose is to initiate an interactive user login flow, redirecting the user's browser to an identity provider (like Azure AD) to authenticate them against the function app itself. It does not provide an access token for the function app's managed identity to programmatically call downstream APIs; it's designed for user-facing authentication to the application.

• ✗

  https://{downstream-api}.azurewebsites.net/.auth/me

  Why it's wrong here

  This endpoint is also part of Azure App Service Authentication/Authorization (Easy Auth) and is used by a client to retrieve the authenticated user's claims and token information *after* a successful login to the application. It provides introspection into the user's identity and associated tokens for the application they just accessed. However, it is not an endpoint for an Azure Managed Identity to acquire an access token to call other Azure AD-protected services; its focus is on user identity details, not service-to-service token acquisition.

• ✗

  https://login.microsoftonline.com/{tenant}/oauth2/v2.0/token

  Why it's wrong here

  This is the standard Azure AD OAuth 2.0 token endpoint used for various OAuth flows, including the client credentials flow. While applications can use this endpoint to acquire tokens, it typically requires them to present their own client ID and a client secret or certificate to authenticate as a service principal. Managed Identities abstract away the need for developers to manage these credentials, acquiring tokens through a different, local mechanism rather than directly calling this public AAD endpoint with explicit application credentials.

• ✓

  http://169.254.169.254/metadata/identity/oauth2/token

  Why this is correct

  This is the correct and secure endpoint for Azure resources configured with a Managed Identity to acquire an access token. The Azure Instance Metadata Service (IMDS) provides this non-routable, local REST endpoint, accessible only from within the Azure resource (e.g., an Azure Function instance). When a managed identity makes a request to this specific IP address, IMDS intercepts it, authenticates the request as coming from the managed identity, and then securely requests an access token from Azure AD on behalf of that identity, returning it to the calling application. This mechanism eliminates the need for developers to manage any credentials.

Go deeper

Related to this question