AZ-204 Implement Azure security Practice Question
Your company uses Azure App Service to host a web application. You need to allow only authenticated users from your Microsoft Entra ID tenant to access the app, without writing any authentication code. Which feature should you configure?
⚠ Common exam trap
Test-takers frequently confuse network-level access controls (like IP restrictions) with identity-based authentication, or mistakenly think SAS tokens can secure a web app URL, when in fact SAS are strictly for Azure Storage access and have no role in user authentication for App Service.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Azure App Service Authentication (EasyAuth) with Microsoft Entra ID as identity provider.
Azure App Service Authentication (EasyAuth) is the correct feature because it provides a built-in, code-free way to authenticate users by integrating with Microsoft Entra ID (formerly Azure AD). When configured, the App Service automatically validates tokens and redirects unauthenticated users to the identity provider, enforcing authentication at the platform level without requiring any changes to the application code.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Azure App Service Authentication (EasyAuth) with Microsoft Entra ID as identity provider.
Why this is correct
Azure App Service Authentication, often referred to as EasyAuth, is the correct choice because it provides a built-in, no-code solution for integrating identity providers like Microsoft Entra ID directly into your web application. It automatically handles the entire authentication flow, including redirecting unauthenticated requests, token acquisition, validation, and session management. This offloads complex security concerns from the application code, allowing developers to secure their web applications with minimal effort and without modifying the application's codebase.
- ✗
IP restrictions in the app’s web.config.
Why it's wrong here
IP restrictions, whether configured in `web.config` or through Azure App Service network settings, control access to the application based solely on the source IP address of the client. While they can restrict network access to specific ranges, they do not provide user authentication or identity verification. This method cannot differentiate between authorized and unauthorized users from a permitted IP range, nor can it integrate with Microsoft Entra ID for user identity management.
- ✗
Client certificate authentication.
Why it's wrong here
Client certificate authentication involves the client presenting a digital certificate to the server for identity verification. While Azure App Service supports client certificates, implementing this for user authentication typically requires the application code to validate the certificate's trust chain, extract user identity information, and manage authorization. This is not a no-code solution and does not directly integrate with Microsoft Entra ID as an identity provider for user authentication without significant custom development.
- ✗
Shared access signatures (SAS) for the app URL.
Why it's wrong here
Shared Access Signatures (SAS) are security tokens primarily used to grant time-limited, delegated access to specific resources within Azure Storage accounts, such as blobs, queues, tables, or files. They are designed for granular control over storage operations, not for authenticating users to a web application hosted on Azure App Service. Applying SAS tokens to an App Service URL would not provide a mechanism for user authentication via Microsoft Entra ID, as their purpose and scope are entirely different.
Go deeper
Related to this question
About these practice questions
This AZ-204 question is part of Courseiva's 881-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.