You have an on-premises app named App1 that accesses Azure resources by using credentials stored in a configuration file. You plan to upgrade App1…

To programmatically authenticate using a service principal via the OAuth 2.0 client credentials grant flow, an application must provide three key pieces of information to the Azure Active Directory (Azure AD) token endpoint. These are:

1. Application (client) ID: A unique identifier for the application registration in Azure AD.

2. Client Secret: A credential generated for the application, acting as its password.

3. Tenant ID: Identifies the specific Azure AD directory (tenant) where the application is registered and against which authentication should occur.

This information is used to construct an authentication request to an endpoint, typically in the format https://login.microsoftonline.com/{tenantid}/oauth2/v2.0/token, to obtain an access token.

A. the application ID, a client secret, and the object ID

The Object ID uniquely identifies the service principal object within a tenant, but it is not used as a parameter in the authentication request to obtain a token.

B. a client secret, the object ID, and the tenant ID

This option is missing the Application (client) ID, which is a required parameter (clientid) to identify the application making the authentication request.

D. the application ID, a client secret, and the subscription ID

The Subscription ID identifies an Azure subscription for resource management. Authentication occurs at the Azure AD tenant level, not the subscription level. The subscription ID is used after authentication.

1. Microsoft Identity Platform Documentation

"Microsoft identity platform and the OAuth 2.0 client credentials flow": This document details the protocol for service-to-service calls. In the "Get a token" section

it shows a sample POST request to the https://login.microsoftonline.com/{tenant}/oauth2/v2.0/token endpoint. The request requires the clientid (Application ID) and clientsecret in the body

and the tenant (Tenant ID) in the URL.

Reference: Microsoft Docs

"Microsoft identity platform and the OAuth 2.0 client credentials flow"

Section: "Get a token".

2. Microsoft Azure Documentation

"Create an Azure service principal with the Azure CLI": This tutorial guides users through creating a service principal. The output of the az ad sp create-for-rbac command

which is used for authentication

includes the appId (Application ID)

password (Client Secret)

and tenant (Tenant ID).

Reference: Microsoft Docs

"How to: Use the portal to create an Azure AD application and service principal that can access resources"

Section: "Get tenant and app ID values for signing in".

3. Microsoft Azure Documentation

"Application and service principal objects in Azure Active Directory": This document clarifies the distinction between different identifiers. It states

"The application object has a globally unique application ID

" and "The service principal object has a unique object ID." It implicitly shows that the Application ID is for identifying the application itself during authentication

while the Object ID is an internal identifier for the instance in the tenant.

Reference: Microsoft Docs

"Application and service principal objects in Azure Active Directory"

Section: "Relationship between application and service principal objects".