Examkin

Question

Difficulty: MediumMulti-tenant Applications Configuration

You are configuring a multi-tenant web application registration in Microsoft Entra ID. The application must allow users from any organizational Microsoft Entra ID tenant to sign in, but it must explicitly block users signing in with personal Microsoft accounts (such as outlook.com or hotmail.com). Which two configurations should you implement to satisfy this requirement? (Select two)

  1. Set the signInAudience parameter in the application manifest to AzureADMultipleOrgsAnswer
  2. Configure the authority endpoint in the application code to use the /organizations tenant placeholderAnswer
  3. C
    Set the signInAudience parameter in the application manifest to AzureADandPersonalMicrosoftAccount
  4. D
    Configure the authority endpoint in the application code to use the /common tenant placeholder

Answer

To configure a multi-tenant application to accept only organizational accounts while excluding personal accounts, you must set the signInAudience parameter to AzureADMultipleOrgs in the manifest and route authentication requests to the /organizations endpoint.
To limit access strictly to work or school accounts across any Microsoft Entra ID tenant, the application manifest must define the sign-in audience as AzureADMultipleOrgs. Correspondingly, client applications must request authorization from the /organizations endpoint to prevent personal accounts from being evaluated.

Step-by-Step Solution

1
Select the appropriate sign-in audience for organizational accounts.
The signInAudience property in the application registration manifest must be set to AzureADMultipleOrgs.
This configuration allows users from any Entra ID tenant (work or school accounts) to authenticate while blocking personal Microsoft accounts.
2
Determine the correct authorization authority endpoint.
The authority URL must use the /organizations endpoint instead of /common.
The /organizations endpoint restricts authentication to Entra ID organizational tenants only, whereas /common would also allow personal Microsoft accounts.

Key Concept

Configuring multi-tenant sign-in audiences and authority endpoints in Microsoft Entra ID
Estimated Time:1m 30s
Rate this question

Topics

Multi-tenant Applications Configuration

More questions from this topic