In Microsoft Entra ID, when one application (App1) needs to access another application's (App2) API securely without user interaction, it uses app-only authentication (also known as client credentials flow).
For app-to-app communication:
* App1 must be granted permissions to App2 (via application permissions).
* App1 must authenticate using credentials that Entra ID recognizes.
The valid credential types are:
* Certificates - Secure method for app authentication using an X.509 certificate.
* Client secrets - A text-based key (password) used to authenticate the app.
Microsoft documentation states:
"Application identity can be established using a client secret or certificate in the client credentials flow." Options B (Managed identity) apply only to Azure resources (not registered apps).
Option D (User account) and E (One-time password) are interactive credentials and not valid for app-only access.
In Microsoft Entra ID, when one application (App1) needs to access another application's (App2) API securely without user interaction, it uses app-only authentication (also known as client credentials flow).
For app-to-app communication:
* App1 must be granted permissions to App2 (via application permissions).
* App1 must authenticate using credentials that Entra ID recognizes.
The valid credential types are:
* Certificates - Secure method for app authentication using an X.509 certificate.
* Client secrets - A text-based key (password) used to authenticate the app.
Microsoft documentation states:
"Application identity can be established using a client secret or certificate in the client credentials flow." Options B (Managed identity) apply only to Azure resources (not registered apps).
Option D (User account) and E (One-time password) are interactive credentials and not valid for app-only access.