Hotspot Question You have an on-premises server named Server1 that runs Windows Server. You have a Microsoft Entra tenant that contains an app registration named App1. App1 has Microsoft Graph…

Question

Answer Area

• In the tenant configure:A Conditional Access policy
  An authentication methodA Conditional Access policyA Microsoft Entra application proxyA permission classification
• Configure scheduled tasks on Server1 to authenticate by using a:User-assigned managed identity
  CertificateClient secretSystem-assigned managed identityUser-assigned managed identity

• An authentication method|Certificate
  100% (1)

Explanation

This question tests your ability to configure a Microsoft Entra app registration to meet security requirements: network restriction, secure credential storage, and non-interactive authentication support for scheduled tasks.

Approach. To restrict App1 to the corporate network only, you should configure a Conditional Access policy that targets App1 and enforces a Named Location (IP range for the corporate network), blocking access from outside. To avoid storing credentials as plain text while enabling non-interactive scheduled tasks, you should use a certificate-based credential (X.509 certificate) for App1 authentication - the certificate private key is stored securely in the Windows Certificate Store on Server1 rather than as plain text. For the non-interactive scheduled tasks, the tasks should authenticate using the client credentials flow (application identity) with the certificate, which means configuring App1 with a certificate credential in Entra ID and using the certificate thumbprint/private key on Server1 for authentication without user interaction.

Concept tested. The core concepts tested are: (1) Entra ID Conditional Access with Named Locations for network-based app access restriction, (2) certificate-based authentication for app registrations as a secure alternative to client secrets (which are stored as plain text), and (3) client credentials flow using certificates to support non-interactive/daemon service authentication for scheduled tasks running on Server1.

Reference. https://learn.microsoft.com/en-us/entra/identity-platform/v2-oauth2-client-creds-grant-flow | https://learn.microsoft.com/en-us/entra/identity/conditional-access/location-condition

No community discussion yet for this question.