AZ-700 Question 109
Single answerYou manage a secure web application hosted behind Azure Application Gateway. The requirement is to enforce user sign-in using Microsoft Entra ID (formerly Azure Active Directory) at the gateway level. Which of the following configurations must you perform in Microsoft Entra ID to ensure that the Application Gateway can successfully redirect users for authentication and handle token responses?
- A
Add the Application Gateway� subnet to the list of trusted subnets in Azure AD.
- B
Configure the redirect URI (Reply URL) in the application registration to match the Application Gateway� authentication callback endpoint.
- C
Create an OAuth2 client secret without enabling ID tokens in the app registration settings.
- D
Enable the Resource Owner Password Credential flow to allow the Application Gateway to handle user credentials directly.
Show answer and explanation
Correct answer: B
Explanation
To enable Microsoft Entra ID (Azure AD) authentication at the Azure Application Gateway level, you must configure the application registration in Microsoft Entra ID with a redirect URI that matches the gateway� callback endpoint. This setup ensures that, when users attempt to access the application, they are redirected to Microsoft Entra ID for authentication and subsequently returned to the gateway with a valid ID token. For detailed guidance, refer to Microsoft� documentation on integrating Azure Application Gateway with Azure Active Directory for authentication: https://learn.microsoft.com/azure/application-gateway/multiple-site-auth-azure-ad.
- A. Incorrect.
Incorrect: Simply adding the Application Gateway� subnet as trusted does not enable or enforce authentication. Trusted subnets in Azure AD is not a standard mechanism for controlling user access; instead, you need a valid redirect URI to handle OAuth2 flows.
- B. Correct.
Correct: When you integrate Microsoft Entra ID with Azure Application Gateway, you must configure a matching Reply URL or Redirect URI in the Microsoft Entra ID app registration settings that points to the Application Gateway� callback endpoint. This ensures tokens can be sent back to the gateway after successful authentication.
- C. Incorrect.
Incorrect: Although creating a client secret can be part of a larger app registration configuration, disabling ID tokens prevents Azure Application Gateway from completing its OpenID Connect flow, as ID tokens are required to validate user identity.
- D. Incorrect.
Incorrect: The Resource Owner Password Credential (ROPC) flow is not recommended for modern browser-based authentication scenarios. Azure Application Gateway enforces redirection to Microsoft Entra ID using the standard OAuth2/OpenID Connect redirect flow rather than collecting credentials directly.