hardMultiple ChoiceObjective-mapped
MS-102 Practice Question: A development team builds a background service…
A development team builds a background service that needs to read all users' calendars via Microsoft Graph without a signed-in user. The service will run on a server with a client secret. Which OAuth 2.0 grant flow should the application use?
⚠ Common exam trap
Many candidates confuse delegated permissions with application permissions and incorrectly choose the authorization code grant, thinking a user context is always required for accessing user data, but the client credentials grant bypasses the user entirely by using app-only permissions.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Client credentials grant
The client credentials grant is designed for server-to-server, non-interactive scenarios where an application authenticates as itself (not on behalf of a user) to access resources. Since the background service runs with a client secret and needs to read all users' calendars without a signed-in user, this flow is the correct choice because it uses the application's own identity to obtain an access token from Microsoft Entra ID.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Authorization code grant
Why it's wrong here
The authorization code grant is an interactive OAuth 2.0 flow in which a resource owner signs in and consents, producing an authorization code that the app exchanges for tokens at the token endpoint. A background service runs with no browser, no redirect URI handler, and no signed-in user, so it cannot initiate the user-interactive consent step. Although refresh tokens can extend a session, the flow fundamentally depends on delegated user authorization and is therefore unsuitable for an unattended daemon.
- ✗
Device authorization grant
Why it's wrong here
Device authorization grant (device code flow) is meant for input-constrained devices such as smart TVs or IoT devices: the device receives a device code and user code, then instructs the user to open a browser on another device, sign in, and enter the code. It still requires a human to authenticate and grant consent interactively, and it results in delegated tokens tied to that user rather than application-only tokens. A background service running on a server has no such interactive user requirement and should instead authenticate itself with client credentials.
- ✓
Client credentials grant
Why this is correct
Client credentials grant is the OAuth 2.0 flow designed for confidential client applications acting as themselves. The daemon authenticates directly to the Microsoft identity platform token endpoint using its client ID and a secret or certificate, and receives an application token containing scopes that were pre-configured as application permissions (app roles). No user consent prompt or redirect is involved, enabling fully unattended execution for a server-hosted background service.
- ✗
Implicit grant
Why it's wrong here
Implicit grant is an OAuth 2.0 flow originally built for browser-based JavaScript SPAs, where the authorization server returns an access token directly in the URL fragment and no client secret is ever used. Because tokens are exposed in the browser history and can be intercepted, and because the flow cannot support the confidential application authentication expected of a daemon, it is fundamentally insecure and technically incompatible with a background service that must keep its credentials secret.
Go deeper
Related to this question
Learn chapter
Microsoft 365 Tenant Setup
Key term
Microsoft Entra ID
Microsoft Entra ID is a cloud-based identity and access management service that lets employees sign in and access resources both inside and outside of your organization.
Key term
Access token
A digital key that a computer system gives you to prove your identity and grant you permission to access specific resources or perform actions.
About these practice questions
Courseiva writes every MS-102 question from scratch — 241 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MS-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MS-102 exam.