Question

A developer at Contoso has built a JavaScript single-page application (SPA) that runs entirely in the browser and calls Microsoft Graph on behalf of the signed-in user. You are registering the app in Microsoft Entra ID. When you configure the platform under Authentication, which platform type and token flow should you select to follow Microsoft's current security recommendations?

Accepted Answer

Add a 'Single-page application' platform, which enables the authorization code flow with PKCE

Answer

Add a 'Web' platform and enable the implicit grant by selecting 'Access tokens' and 'ID tokens'

Answer

Add a 'Mobile and desktop applications' platform using the native client redirect URI

Answer

Add a 'Web' platform and configure a client secret for the SPA to use the client credentials flow