Deploy and manage a Microsoft 365 tenant →hardMultiple Choice

MS-102 Deploy and manage a Microsoft 365 tenant Practice Question

Exhibit

Refer to the exhibit.

{
  "appId": "00000003-0000-0000-c000-000000000000",
  "displayName": "Microsoft Graph",
  "passwordCredentials": []
}

Refer to the exhibit. You are reviewing the service principal for Microsoft Graph in your tenant. The passwordCredentials array is empty. What does this indicate?

⚠ Common exam trap

Microsoft often tests the misconception that an empty passwordCredentials array means the service principal is disabled or that no authentication is possible, when in fact other authentication methods like certificates or federated credentials may still be configured.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

No client secret is configured for the service principal.

The passwordCredentials array being empty indicates that no client secret (password) has been configured for the service principal. Client secrets are one method of authentication for service principals, and their absence means that this particular authentication method is not set up. This does not imply the service principal is disabled or that other authentication methods like certificates or federated credentials are in use.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The service principal is using federated credentials.
Why it's wrong here
Federated credentials are stored in the `federatedIdentityCredentials` collection of the service principal, not in `passwordCredentials`. An empty `passwordCredentials` array therefore cannot be read as evidence that workload identity federation is in use; it only tells you no password-based client secret exists. The two properties are independent, so a service principal can have federated credentials while still showing an empty password credential list.
✗
The service principal uses certificate-based authentication.
Why it's wrong here
Certificate-based authentication relies on objects in the `keyCredentials` array on the service principal, where public key information and certificate metadata are stored for use in the client credentials flow. An empty `passwordCredentials` array indicates only that no client secret string is configured; it does not indicate whether certificates are configured. To determine certificate usage, you must inspect `keyCredentials`, which is a separate and independent property.
✗
The Microsoft Graph application is disabled.
Why it's wrong here
The disabled state of an application is controlled by the `accountEnabled` Boolean property on the service principal or the corresponding application object, not by the presence or absence of secrets. An empty `passwordCredentials` array merely means no client secret is assigned; the service principal can still be enabled and fully functional using other authentication methods. Therefore, this exhibit does not support the conclusion that the Microsoft Graph application is disabled.
✓
No client secret is configured for the service principal.
Why this is correct
A `passwordCredentials` array with no entries in the service principal means there are no password credential objects, and therefore no client secret is configured for that service principal. Client secrets are created and stored in this property as `passwordCredentials` objects, so an empty array is the expected representation when a secret has never been created, has expired, or has been deliberately removed. Without a client secret, app-only authentication would need another credential such as a certificate or managed identity, but the displayed data directly supports only the no-client-secret conclusion.

Go deeper

MS-102 Deploy and manage a Microsoft 365 tenant Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question