An assistant agent must call a downstream Microsoft Graph API to read only the signed-in user’s calendar. Compliance forbids the agent from using an app-only permission that can read all calendars in the tenant. Which authentication flow should you design?
Select an answer to reveal the explanation.
Short Explanation
A is correct. Multi-agent auth flows include user impersonation, on-behalf-of, API keys, and OAuth 2.0. For “only this user’s calendar,” you need delegated OBO (or equivalent user-context) so Graph sees the signed-in user, not app-only tenant-wide read. App-only Calendar.Read for all users violates the compliance constraint. ROPC with passwords is deprecated/unsafe. Global admin tokens are extreme over-privilege. Design OBO through your API layer carefully with consent and token exchange.
Full Explanation
Correct Answer — A
Authentication flows in multi-agent solutions include user impersonation, on-behalf-of, API keys, and OAuth 2.0. Reading only the signed-in user’s calendar requires delegated OBO/user context rather than tenant-wide app-only permissions.
Why B is wrong: App-only tenant-wide calendar read violates least privilege and the stated compliance rule.
Why C is wrong: Resource owner password credentials are insecure and not appropriate for modern agent tool auth.
Why D is wrong: Global admin tokens massively over-privilege the agent system.
Exam tip: User-scoped Graph access → OAuth OBO/delegated, not app-only all-users.