AZ-500 Question 30
Select 2Your organization has a single-page JavaScript application that currently uses the Implicit Grant flow to authenticate users through Microsoft Entra ID. Due to new security requirements, you must switch to the OAuth 2.0 authorization code flow with Proof Key for Code Exchange (PKCE). Which two actions should you take in the application’s Microsoft Entra app registration to enable this new flow?
- A
- In the Authentication blade, disable implicit grant access tokens and ID tokens under Implicit grant and hybrid flows.
- B
- In the Authentication blade, add a single-page application (SPA) redirect URI and select “Authorization code (PKCE)” and “ID tokens.”
- C
- In the Certificates & secrets blade, create a new client secret called “PKCE” to store the code verifier for the application.
- D
- In the API Permissions blade, remove all default delegated permissions to rely solely on PKCE for authentication.
Show answer and explanation
Correct answers: A, B
Explanation
To switch a single-page application from the Implicit Grant flow to the OAuth 2.0 authorization code flow with PKCE, you must update the app registration settings to disable implicit grants and configure the SPA redirect URI. PKCE involves creating a dynamic code challenge at runtime rather than storing it in a secret. This approach enhances security and aligns with best practices outlined in Microsoft documentation (for example, see 'Configure authentication in a single-page application' in the Microsoft Entra developer guidance).
- A. Correct.
Disabling implicit grant tokens is recommended when you switch to the authorization code flow with PKCE, as it prevents older flows from being used and reduces potential attack vectors.
- B. Correct.
Configuring the SPA redirect URI and enabling “Authorization code (PKCE)” ensures the application can securely exchange authorization codes and use PKCE to mitigate token interception attacks. Selecting “ID tokens” allows the app to obtain user information for sign-in.
- C. Incorrect.
PKCE is generated dynamically during the authorization process; it is not stored as a client secret. Storing the code verifier in a secret would defeat the purpose of PKCE.
- D. Incorrect.
Removing all delegated permissions is not a requirement for implementing the authorization code flow with PKCE. You still need valid permissions for the application to access resources on behalf of the signed-in user.