A samphire-harvest SPA and a confidential server web app both need interactive user sign-in to Microsoft Entra ID. Which OAuth flow should the developer select for modern interactive users?
Select an answer to reveal the explanation.
Short Explanation
Authorization code with PKCE is today’s front door for people signing in—SPA or server web. Implicit grant is the old side door. Client credentials is app-only, and password grant is not the interactive path you want.
Full Explanation
The Microsoft identity platform recommends authorization code flow with PKCE for interactive user authentication in SPAs and web apps. Implicit grant is legacy. ROPC is discouraged for interactive scenarios, and client credentials is an application-only flow without a signed-in user.