Alpine HR Solutions is building a Copilot Studio agent that allows employees to query their own leave balances and submit time-off requests through a third-party REST API. The HR system supports OAuth 2.0 and the agent must access data on behalf of the signed-in employee — not as a background service. The agent is deployed in the Microsoft Teams channel where employees are already authenticated with their corporate identity. Which OAuth 2.0 flow should the team configure for the agent's connection to the HR REST API?
Select an answer to reveal the explanation.
Short Explanation and Infographic
The authorization code flow is like a notarized permission slip — the employee goes to the HR system, approves the agent's access, and the HR system hands back a code that the agent exchanges for a token. Option C is correct because access-on-behalf-of scenarios require authorization code flow with PKCE; client credentials would give the agent access to everyone's data, not just the signed-in employee.
Full explanation below image
Full Explanation
OAuth 2.0 has several flows optimized for different scenarios. When an agent must access data on behalf of a specific signed-in user — a 'delegated permission' scenario — the authorization code flow is the correct choice. In Copilot Studio, you configure this under 'Authentication' settings for a topic or at the agent level, providing the client ID, client secret (stored securely), authorization endpoint, token endpoint, and required scopes.
Option C is correct. The authorization code flow with PKCE (Proof Key for Code Exchange) is the modern, secure form of the authorization code flow, recommended for all new implementations. PKCE prevents authorization code interception attacks. When an employee first uses the agent, they are redirected to the HR system's login/consent page, approve the requested scopes, and the HR system issues an authorization code. The agent exchanges that code for an access token scoped to that specific employee's permissions.
Option A is wrong. Client credentials flow authenticates the application (agent) as itself — not on behalf of any user. This is appropriate for unattended, background agents but would give the agent access to all employees' data (governed only by the service account's permissions), violating the requirement to access data for the signed-in employee specifically.
Option B is wrong. The ROPC flow requires collecting the user's raw credentials, which is a major security anti-pattern. Microsoft has deprecated ROPC for most scenarios and it cannot be used with accounts that have MFA enabled. Collecting HR usernames and passwords in a question node is dangerous and likely prohibited by the HR vendor's terms of service.
Option D is wrong. The implicit flow has been deprecated by the OAuth 2.0 Security Best Current Practice because it returns tokens in URL fragments (visible in browser history and referrer headers) without the security of a code exchange. Modern implementations use authorization code + PKCE instead.
Exam tip: Map OAuth flows to scenarios: client credentials = unattended/service-to-service; authorization code + PKCE = user-delegated/on-behalf-of; ROPC = avoid; implicit = deprecated. AB-620 will test whether you know which flow fits the delegation requirement.