Exam AZ-204 topic 13 question 4 discussion

You need ID Token Claims for authorisation. You need to validate ID Token signature as a part of authentication. So the correct answer is A. Having both D & E does not make sense, URI has tenant ID in it, so answer D.

it should be D & E

https://learn.microsoft.com/en-us/entra/identity-platform/claims-validation To validate the ID token we need to validate its signature (to ensure it has not been tampered= and we need to validate the AUD claim (The application ID is sent as the audience (‘aud’) claim in the access token.) So I believe it's A and B

For Authentication is DE, you need the endpoint and the tenant you are authenticating against Post Authentication is AB post autentication we will use claims and can use signature to verify the response so it depends what the guys are asking. I think they are asking what will you use to authenticate and in that case it has to be DE. not AB which you don't know prior to authenticate. the Signature and claims are received after sending the authentication request when we perform a id_token request

is the right answer

I think the correct answer is A and B based on the following: https://learn.microsoft.com/en-us/entra/identity-platform/v2-protocols-oidc#validate-the-id-token "Receiving an ID token in your app might not always be sufficient to fully authenticate the user. You might also need to validate the ID token's signature and verify its claims per your app's requirements." Since the app Id is mentioned in the requirements, I assume that you need to validate the signature and the aud claim

D contains E

Appeared in exam I took at 27-5-2023 I chose A and D

This question came on jan9,2023. Choose d,e. Score 834

Guys this is a standard Sign-in flow. I think the correct answer is AE. First you need to know the tenant it so you'll be able to send a sign in request GET https://login.microsoftonline.com/{tenant}/oauth2/v2.0/authorize? and in reply you'll get a id_token (JWT), which in turn can be used to get an access token to UserInfo endpoint. I'm not 100% sure, but this way, it makes sense to me.

correct ans

Answer A+ B "Each correct answer presents part of the solution" From a JWT the header and signature are used to verify the authenticity of the token. The signature is raw information to verify so A is correct. The claims in the header you need to validate this signature of the token , especially the 'kid' claim. So you need header claims (these are token claims, answer B) as well. https://learn.microsoft.com/en-us/azure/active-directory/develop/id-tokens https://learn.microsoft.com/en-us/azure/active-directory/develop/access-tokens

"Which two values should you use?" Where, Microsoft, where? While forwarding the request to an authorize endpoint to retrieve an ID token? Or while validating the id-token-signature? The question creator had something in his mind when he suddenly stopped thinking. We have to guess where he stopped. This is a psychology question

1. The user have to authenticate clicking on a link in the web app. It means that the "tenant ID" of the AD is used here, not the URI. 2. You have to use the aud claim to ensure that the user intended to call the application. If the identifier of the resource isn't in the aud claim, reject it. https://docs.microsoft.com/en-us/azure/active-directory/develop/access-tokens#validating-tokens In my opinion, the right answers are: B: ID token claims E: Azure AD tenant ID Not sure at all, but there was the right options choose by others exam website.

Claims are for authorization. The signature is used for authentication, and the endpoint url includes the tenant id, so A&D are correct by process of elimination.

Authentication is not sign in! So for example API Management needs to check whether the user is as stated. So it needs * D to find the correct authentication "service". * And to check if the user is as stated "A" is needed, since this is the only option that contains information about the user. B is not viable since the claims alone are not trustworthy. I don't know why E would help and it can surely not replace A or D. C is surely not needed since it contains neither information about the user nor the AD.

To authenticate, you need to know the url of auth service api and the tenant id i.e. https://login.microsoftonline.com/{tenant}/oauth2/v2.0/authorize? client_id=6731de76-14a6-49ae-97bc-6eba6914391e &response_type=code &redirect_uri=http%3A%2F%2Flocalhost%2Fmyapp%2F &response_mode=query after visiting that url, it will be presented the AD consent and login, then auth code is appended to the redirect url, which can be used to get the access token. so answer is D and E.