Building Applications and Solutions with Microsoft 365 Core Services (legacy) — Question 16

You plan to develop a client-side JavaScript web app that will be registered to the Microsoft identity platform and use Microsoft Authentication Library (MSAL) v2.0.
Which type of authorization flow should you use?

Answer options

• A. client credentials grant
• B. device code
• C. resource owner password credentials grant
• D. authorization code grant

Correct answer: D

Explanation

The authorization code grant is suitable for client-side applications because it allows for secure authorization without exposing sensitive information. The client credentials grant is not appropriate for user authorization scenarios, while the device code flow is more suited for devices that lack a browser, and the resource owner password credentials grant is generally discouraged due to security concerns.