What happens when a user signs in to an Azure/Entra-protected application?
What they are really testing: Whether you understand the OAuth2/OIDC flow, tokens issued, and where MFA and Conditional Access fit. Connects the identity basics to a real sign-in.
A real interview question
What happens when a user signs in to an Azure/Entra-protected application?
What most people say
drag me
“The user types their password and Entra logs them in.”
It ignores the whole OIDC flow, the tokens issued, and where MFA and Conditional Access apply. The interviewer wants the redirect-verify-token-validate flow, not just password in.
The follow-ups they ask next
Where does Conditional Access fit in the sign-in?
During authentication at Entra: it evaluates signals (user, device, location, risk) and enforces a decision, allow, block, or require MFA/compliant device, before tokens are issued. It is the Zero Trust policy gate.
What tokens does Entra issue and what are they for?
An ID token (proves who the user is, for the app) and access tokens (bearer tokens to call APIs/resources). Both are signed JWTs the recipient validates by signature and claims.
What the interviewer is listening for
- Describes the OIDC redirect/token flow
- Knows app never sees the password
- Places MFA + Conditional Access correctly
What sinks the answer
- Just "types password"
- No notion of tokens/OIDC
- Unaware of Conditional Access
If you genuinely do not know
Say this instead of freezing. Reasoning out loud from what you do know beats silence every single time, and a good interviewer is listening for exactly that.
“Sign-in is [delegated/token-based, the app never handles the password]. [App redirects to Entra (OIDC)]. [Entra verifies, applying MFA and Conditional Access (device/location/risk signals)]. [Entra issues JWT ID + access tokens]. [The app validates the token and authorizes via role/group claims or Azure RBAC]. Credentials stay with the identity provider.”
Keep going with azure
Foundation
What is Microsoft Entra ID (formerly Azure AD), and how does authentication work in Azure?
Foundation
In Azure, what handles authentication versus authorization?
Foundation
Explain the Azure resource hierarchy: tenant, management group, subscription, resource group.
Junior
How does Azure RBAC work? Explain roles, scopes, and assignments.
Junior
What is the difference between a service principal and a managed identity, and why prefer managed identities?
Junior
What is Azure Key Vault, and how should an application access a secret from it securely?
Knowing the answer is not the same as recalling it under pressure
Sign in to send the questions you fumble to spaced recall, so they come back right before you would forget them, and learn the concepts behind them with hands-on labs.
Start free