AZ-204 Implement Azure security Practice Question
Your Azure Logic App needs to send emails using Microsoft Graph API on behalf of the signed-in user. The user is authenticated with Microsoft Entra ID. Which authentication method should you use in the Logic App?
⚠ Common exam trap
Many exam-takers confuse delegated permissions (user context) with application permissions (app-only context), leading them to choose client credentials flow (Option C) or managed identity (Option B) when the requirement explicitly says 'on behalf of the signed-in user'.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use OAuth 2.0 authorization code flow with delegated permissions
The OAuth 2.0 authorization code flow with delegated permissions is correct because the Logic App needs to act on behalf of the signed-in user, not as an application itself. This flow allows the user to authenticate via Microsoft Entra ID and grant the Logic App delegated permissions to call Microsoft Graph API (e.g., to send emails as the user). The authorization code is exchanged for an access token that includes the user's context, enabling the API to enforce user-level permissions.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Use OAuth 2.0 authorization code flow with delegated permissions
Why this is correct
The OAuth 2.0 authorization code flow with delegated permissions is the correct choice because it enables the Logic App to act on behalf of a specific signed-in user. This flow involves the user consenting to the application accessing their resources, granting the Logic App temporary, user-scoped permissions to send emails as that user via Microsoft Graph. It ensures that the email appears to originate from the user's mailbox, respecting their identity and permissions.
- ✗
Use a system-assigned managed identity
Why it's wrong here
Using a system-assigned managed identity is incorrect because managed identities provide an identity for the Azure resource itself, not for a specific user. While a Logic App can use a managed identity to authenticate to other Azure services, it represents the application principal and cannot impersonate a user to send emails 'on behalf of' them through Microsoft Graph's user-centric APIs. This approach lacks the necessary user context for delegated operations.
- ✗
Use client credentials flow with an app registration
Why it's wrong here
The client credentials flow with an app registration is unsuitable for sending emails on behalf of a user because it is an application-only authentication flow. This flow grants permissions directly to the application itself, without a user context, making it ideal for daemon services or background processes. While an application could send emails with appropriate application permissions, they would originate from a designated mailbox associated with the application, not from a specific end-user's mailbox.
- ✗
Use Basic authentication with user credentials
Why it's wrong here
Basic authentication with user credentials is not supported by Microsoft Graph for any operations, including sending emails. Microsoft Graph exclusively uses OAuth 2.0 for all authentication and authorization, providing a more secure and robust framework for managing access. Attempting to use Basic authentication would result in an authentication failure, as it is a legacy and insecure method incompatible with modern Microsoft APIs.
Go deeper
Related to this question
About these practice questions
Courseiva writes every AZ-204 question from scratch — 881 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.