Describe the capabilities of Microsoft Entra →mediumMultiple ChoiceObjective-mapped

SC-900 Describe the capabilities of Microsoft Entra Practice Question

Exhibit

Refer to the exhibit.
{
  "appId": "00001111-aaaa-2222-bbbb-3333cccc4444",
  "displayName": "HRApp",
  "passwordCredentials": [
    {
      "hint": "abc",
      "endDateTime": "2025-12-31T23:59:00Z"
    }
  ],
  "api": {
    "knownClientApplications": [],
    "requestedAccessTokenVersion": 2
  }
}

Refer to the exhibit. The JSON snippet shows an app registration in Microsoft Entra ID. The password credential endDateTime is set to 2025-12-31. What will happen when that date is reached?

⚠ Common exam trap

Many exam-takers assume secrets auto-renew or that the app registration is deleted, but Microsoft Entra ID treats secrets as static credentials that must be manually managed before expiration.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The app will be unable to authenticate using that secret.

When the password credential (client secret) reaches its endDateTime, the secret expires and becomes invalid. Microsoft Entra ID does not automatically renew secrets; the application must use a valid secret to authenticate. Once expired, any authentication attempt using that secret will fail, preventing the app from obtaining tokens.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The secret will renew automatically.
Why it's wrong here
Client secrets in Azure AD app registrations are security credentials that require explicit management. Unlike user passwords that might prompt for renewal, application secrets have a fixed expiration date and do not automatically extend or renew. Administrators or automated processes must proactively generate new secrets and update applications before the current ones expire to maintain service continuity and security.
✓
The app will be unable to authenticate using that secret.
Why this is correct
When an application's client secret reaches its expiration date, it becomes invalid and can no longer be used to authenticate with Azure Active Directory. Any attempt by the application to acquire an access token using this expired secret will result in an authentication failure. This prevents the application from accessing protected resources or performing actions on behalf of itself.
✗
The app registration will be automatically deleted.
Why it's wrong here
The expiration of a client secret does not lead to the deletion of the entire app registration within Azure Active Directory. An app registration is the foundational identity object for an application, while a client secret is merely one of its associated credentials. The app registration itself, along with its configuration, permissions, and any other valid credentials, will remain intact and functional.
✗
The app will be blocked from signing in.
Why it's wrong here
An application will not necessarily be blocked from signing in simply because one of its client secrets has expired. App registrations can be configured with multiple credentials, such as several client secrets with staggered expiration dates or X.509 certificates. If other valid credentials exist, the application can still successfully authenticate and acquire tokens using those alternatives, ensuring continued operation.

Go deeper

SC-900 Describe the capabilities of Microsoft Entra Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question