A security engineer needs to configure Microsoft Entra ID to enforce that all OAuth 2.0 applications accessing Azure OpenAI must use the authorization code flow with PKCE (Proof Key for Code Exchange) instead of the implicit flow. Which Entra ID configuration enforces this requirement?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — a is correct because in Microsoft Entra ID application registrations, the implicit grant flow can be disabled by unchecking the 'Access tokens' and 'ID tokens' options under Authentication > Implicit grant and hybrid flows. When implicit grant is disabled, client applications cannot use the implicit flow and must use authorization code flow (which can be combined with PKCE for public clients).
Full explanation below image
Full Explanation
A is correct because in Microsoft Entra ID application registrations, the implicit grant flow can be disabled by unchecking the 'Access tokens' and 'ID tokens' options under Authentication > Implicit grant and hybrid flows. When implicit grant is disabled, client applications cannot use the implicit flow and must use authorization code flow (which can be combined with PKCE for public clients). A is the most direct enforcement mechanism. B is incorrect because Conditional Access policies control access decisions (MFA, device compliance, location) but cannot enforce specific OAuth 2.0 grant types or require PKCE at the authentication protocol level. C is incorrect because managed identities use client credentials flow for service-to-service authentication, not authorization code flow; PKCE is for user-facing flows. D is incorrect because 'oauth2RequirePostResponse' in the manifest controls whether OAuth 2.0 responses use form_post, not whether PKCE is required.