Question

A company builds a web API (API-A) that must call a downstream API (API-B) on behalf of the signed-in user. Both APIs are registered in Microsoft Entra ID. The security team requires that the downstream call preserve the user's identity and delegated permissions rather than using an application-only identity. Which OAuth 2.0 flow should you recommend for API-A to obtain a token for API-B?

Accepted Answer

On-Behalf-Of (OBO) flow using the user's incoming access token to request a token for API-B

Answer

Client credentials flow using API-A's application secret to request an app-only token for API-B

Answer

Authorization code flow initiated again from API-A to redirect the user to sign in for API-B

Answer

Device code flow to acquire a token for API-B from the middle-tier service