How to Secure an API with OAuth 2.0 and OpenID Connect
A company is designing a secure API for a customer-facing application that will handle sensitive personal data. They need to ensure that only authorized client applications can call the API and that the identity of the end-user is verified. Which of the following should they implement?
Quick Answer
The answer is OAuth 2.0 with client credentials and OpenID Connect because this combination solves both halves of the security requirement: OAuth 2.0 using the client credentials grant authenticates the calling application, while OpenID Connect adds the essential identity layer to verify the end-user. Together, they ensure that only authorized client applications can invoke the API and that the user’s identity is cryptographically confirmed via an ID token. On the Microsoft Cybersecurity Architect exam, this scenario tests your ability to distinguish between authentication and authorization protocols—a common trap is confusing JWT (a token format) with a full protocol, or thinking API keys alone are sufficient for user verification. Remember the memory tip: OAuth handles the “what you can do” (authorization), and OpenID Connect handles the “who you are” (authentication); for a secure API handling sensitive data, you always need both.
⚠ Common exam trap
SC-100 often tests the distinction between authentication and authorization, causing candidates to pick API keys or JWT alone when the requirement explicitly includes verifying both the client application and the end-user identity.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
OAuth 2.0 with client credentials and OpenID Connect
OAuth 2.0 with client credentials authenticates the client application, while OpenID Connect (OIDC) adds an identity layer to verify the end-user's identity via ID tokens. This combination ensures both client authorization and user authentication, which are the two requirements. OAuth 2.0 alone handles authorization, and OIDC extends it for authentication.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
HTTP Basic Authentication
Why it's wrong here
HTTP Basic Authentication transmits base64-encoded credentials with every request and authenticates only the calling client, not the end-user, so it cannot verify user identity or support delegated scopes. It fits internal tooling or legacy systems where a static service credential suffices.
- ✓
OAuth 2.0 with client credentials and OpenID Connect
Why this is correct
Client credentials authenticates the calling application, while OpenID Connect adds an identity layer atop OAuth 2.0 that verifies the end-user via ID tokens. Together they satisfy both constraints: authorised client applications and verified end-user identity for sensitive personal data.
- ✗
JWT bearer tokens
Why it's wrong here
JWT bearer tokens carry claims but do not by themselves authenticate the calling client application or verify the end-user; they are validated by the API after an authorisation server issues them. They suit delegated access where Microsoft Entra ID has already authenticated both client and user and issued the token.
- ✗
API keys
Why it's wrong here
API keys identify the calling application only; they carry no user context, so end-user identity cannot be verified and keys are long-lived shared secrets. They are tempting for simple service-to-service authentication, but the requirement for delegated user identity needs OAuth 2.0 with OpenID Connect.
Go deeper
Related to this question
About these practice questions
This SC-100 question is part of Courseiva's 605-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SC-100
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company is developing a web API that will be consumed by partner applications. They need to secure the API using OAuth 2.0 and issue access tokens that expire after 1 hour. Which Microsoft Entra ID feature should they use?
easy- A.Managed Identity
- ✓ B.App registration
- C.Conditional Access
- D.Azure AD B2C
Why B: Microsoft Entra ID (formerly Azure AD) provides OAuth 2.0 token issuance through app registrations. Option B is correct. Option A (Managed Identity) is wrong because it is used for Azure resources to authenticate without credentials, not for issuing tokens to partner apps. Option C (Conditional Access) is wrong because it enforces access policies, not token issuance. Option D (Azure AD B2C) is wrong because it is designed for customer identity and access management, not for partner application scenarios.
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Microsoft exam blueprint
This SC-100 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-100 exam.