For an application (service principal) like App1 to authenticate itself and access another application's API like App2, it must present its own credentials. The Microsoft identity platform supports two primary types of credentials for application identities. The first is a client secret, which is a string value that acts as an application-specific password. The second, and more secure, method is a certificate. With this method, the application uses its private key to sign a JSON Web Token (JWT) assertion, which is then used to prove its identity to Microsoft Entra ID. Both methods allow the application to authenticate without any user interaction, which is typical for service-to-service communication.

B. managed identity: A managed identity is an identity for an Azure resource (e.g., a VM or App Service), not a credential type that is configured on a generic application registration itself.

D. user account: A user account is used for delegated authentication, where an application acts on behalf of a signed-in user, not for authenticating the application itself.

E. one-time password: This is a form of multi-factor authentication for user accounts and is not applicable to application service principals.

1. Microsoft Entra documentation

"Application and service principal objects in Microsoft Entra ID": Under the "Service principal authentication" section

it states: "The Microsoft identity platform supports two types of authentication for service principals: password-based authentication (client secret) and certificate-based authentication." This directly confirms that certificates and secrets are the valid credential types.

2. Microsoft identity platform documentation

"Microsoft identity platform and the OAuth 2.0 client credentials flow": This document details the protocol for service-to-service calls. In the "Get a token" section

it shows two distinct protocol requests: the first uses a clientsecret parameter

and the second uses a clientassertion parameter

which is a JWT signed by a certificate. This demonstrates the two credential mechanisms at the protocol level.

3. Microsoft Entra documentation

"Quickstart: Register an application with the Microsoft identity platform": In the "Add credentials" section

the steps guide the user to add either a "Client secret" or a "Certificate" to the application registration

reinforcing these are the two available options.