How to Secure an API with OAuth 2.0 and OpenID Connect
A company is designing a secure API for a customer-facing application that will handle sensitive personal data. They need to ensure that only authorized client applications can call the API and that the identity of the end-user is verified. Which of the following should they implement?
Quick Answer
The answer is OAuth 2.0 with client credentials and OpenID Connect because this combination solves both halves of the security requirement: OAuth 2.0 using the client credentials grant authenticates the calling application, while OpenID Connect adds the essential identity layer to verify the end-user. Together, they ensure that only authorized client applications can invoke the API and that the user’s identity is cryptographically confirmed via an ID token. On the Microsoft Cybersecurity Architect exam, this scenario tests your ability to distinguish between authentication and authorization protocols—a common trap is confusing JWT (a token format) with a full protocol, or thinking API keys alone are sufficient for user verification. Remember the memory tip: OAuth handles the “what you can do” (authorization), and OpenID Connect handles the “who you are” (authentication); for a secure API handling sensitive data, you always need both.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
OAuth 2.0 with client credentials and OpenID Connect
OAuth 2.0 with client credentials grant authenticates the client application, while OpenID Connect extends OAuth 2.0 to verify the end-user's identity. Together, they satisfy both requirements: only authorized clients can call the API and the end-user's identity is confirmed. Option A (HTTP Basic Authentication) transmits credentials in plaintext and does not support user identity verification beyond the client. Option C (JWT bearer tokens) is a token format, not a full authentication protocol; it lacks client authentication and user verification on its own. Option D (API keys) only authenticate the client, not the user, and are typically used for simple access control.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
HTTP Basic Authentication
Why it's wrong here
HTTP Basic Authentication sends credentials in plaintext and does not provide client authentication or user identity verification in a secure manner for sensitive data.
- ✓
OAuth 2.0 with client credentials and OpenID Connect
Why this is correct
OAuth 2.0 with client credentials grant authenticates the client application, and OpenID Connect adds user authentication, ensuring both the client app and the end-user are verified.
- ✗
JWT bearer tokens
Why it's wrong here
JWT bearer tokens are a token format, not an authentication protocol; they lack built-in client authentication and user verification mechanisms.
- ✗
API keys
Why it's wrong here
API keys only authenticate the client application, not the end-user, and provide no user identity verification.
Go deeper
Related to this question
About these practice questions
This SC-100 question is part of Courseiva's 208-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SC-100
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company is developing a web API that will be consumed by partner applications. They need to secure the API using OAuth 2.0 and issue access tokens that expire after 1 hour. Which Microsoft Entra ID feature should they use?
easy- A.Managed Identity
- ✓ B.App registration
- C.Conditional Access
- D.Azure AD B2C
Why B: Microsoft Entra ID (formerly Azure AD) provides OAuth 2.0 token issuance through app registrations. Option B is correct. Option A (Managed Identity) is wrong because it is used for Azure resources to authenticate without credentials, not for issuing tokens to partner apps. Option C (Conditional Access) is wrong because it enforces access policies, not token issuance. Option D (Azure AD B2C) is wrong because it is designed for customer identity and access management, not for partner application scenarios.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-100 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-100 exam.