Provide some scenario's on this values -> Verify and Sign in KeyCredential usage property

Question

I am little bit confused with the documentation of Certificate Credential flow.

Above documentation link -> https://learn.microsoft.com/en-us/graph/api/resources/keycredential?view=graph-rest-1.0#properties

In another document it was mentioned like below

Above documentation link -> https://learn.microsoft.com/en-us/graph/api/application-addkey?view=graph-rest-1.0&tabs=http#request-body

Give me clarity on the above values.

type should be either of this values -> AsymmetricX509Cert, X509CertAndPassword

(OR)

type should be either of this values -> Symmetric , AsymmetricX509Cert,

Which one is correct?

Also could you please provide one scenario with examples where I can use the usage type "Sign".

Answer 1

@Shekhar Nadide

Thank you for reaching out to the community forum!

I understand that you would like to know the usage property of the KeyCredential object in Microsoft Graph API.

The correct types for key credentials in the context of adding a new application key credential are AsymmetricX509Cert and X509CertAndPassword.

The AsymmetricX509Cert is generally used for verification purposes, The usage for this type must be Verify. While X509CertAndPassword can be used for signing, as indicated by the need to include a password, the usage for this type must be Sign.

When a user authenticates with Azure AD, they receive an access token that contains their identity information. You can use the KeyCredential object with the "Sign" usage to sign this token, which creates a digital signature that can be verified by the application's backend. This provides an additional layer of security, as the backend can verify that the token was signed by a trusted source.

Hope this helps. Do let us know if you any further queries.

Thanks,

Akhilesh.

---

If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.