AZ-500 Question 143
Single answerYou manage an Azure API Management instance that exposes financial APIs to partner applications. The security team requires that all client applications present a valid OAuth 2.0 token issued by Azure Active Directory before being granted access to the backend. You also need to ensure that token validation happens at the API Management layer rather than on the backend services. Which configuration should you implement to meet these requirements?
- A
Configure a subscription key in the inbound policy and rely on the backend to validate tokens.
- B
Use the 'validate-jwt' inbound policy with Azure AD as the identity provider to check the token's signature and claims.
- C
Enable mutual certificate authentication in the inbound policy and ignore OAuth 2.0 tokens.
- D
Implement basic authentication in a custom policy and verify credentials against Azure AD.
Show answer and explanation
Correct answer: B
Explanation
To authenticate and authorize client applications with Azure AD tokens in Azure API Management, Microsoft recommends using the 'validate-jwt' policy in the inbound flow. This policy checks the token’s signature and claims (including issuer and audience) against Azure AD, ensuring that only valid tokens reach the backend. More details can be found in the official Microsoft documentation on securing APIs with OAuth 2.0 and the 'validate-jwt' policy (https://learn.microsoft.com/azure/api-management/api-management-howto-protect-backend-with-aad).
- A. Incorrect.
Incorrect. While subscription keys in Azure API Management provide a layer of security, they do not verify OAuth 2.0 tokens. The backend would still need to perform token validation, which goes against the requirement that token validation must occur at the API gateway.
- B. Correct.
Correct. The 'validate-jwt' policy in Azure API Management is designed to validate tokens issued by an identity provider (e.g., Azure AD). This ensures tokens are verified for signature, issuer, audience, and claims before traffic is passed to the backend.
- C. Incorrect.
Incorrect. Mutual certificate authentication involves client certificates, not OAuth 2.0 tokens. Mutual TLS can be used in addition, but it does not fulfill the requirement of validating Azure AD-issued tokens.
- D. Incorrect.
Incorrect. Basic authentication is not appropriate for token-based authentication with Azure AD. Storing or passing credentials this way can increase security risks and does not align with OAuth 2.0 best practices.