Configure the application to use Microsoft Entra ID as an identity provider using OpenID Connect or OAuth 2.0 is the correct choice.

Using Microsoft Entra ID with OpenID Connect or OAuth 2.0 allows the web application to delegate authentication to a managed identity service and receive standardized tokens for secure access. The platform handles sign in flows, token issuance, single sign on and optional multi factor authentication so your app does not need to manage user credentials directly.

The Microsoft identity platform and libraries such as MSAL integrate with Microsoft Entra ID and simplify acquiring and validating tokens in your application. This approach follows cloud security best practices and reduces operational overhead when hosting a web app in Azure.

Use Microsoft Entra External ID formerly known as Azure AD B2C with a custom policy is not the best choice for standard enterprise sign in. Entra External ID is targeted at consumer and external identity scenarios and for custom user journeys and social identity providers so it is more complex than needed for typical organization user authentication.

Deploy a self hosted OpenID Connect provider and perform authentication against it is incorrect because running your own identity provider adds significant operational and security responsibility and duplicates functionality that Microsoft Entra ID already provides as a managed service. For most Azure hosted apps the managed identity platform is the preferred option.

Call the Microsoft Graph API to try to validate user credentials at runtime is wrong because Microsoft Graph is not an authentication endpoint and it does not accept raw user credentials for sign in. Authentication must be performed using OAuth 2.0 or OpenID Connect flows so that your app receives and validates tokens.

Full AWS Practitioner Certification Question