Examkin

Question

Difficulty: MediumApp Registrations and Service Principals

You are developing a multi-tenant web application that will be hosted in Azure. The application must access Microsoft Graph API on behalf of signed-in users from various external Microsoft Entra ID tenants. When a customer's tenant administrator consents to the application, a local representation of your application must be created in their tenant to define permissions and access controls. Which object is created in the customer's tenant to represent this local instance of the application?

  1. A service principalAnswer
  2. B
    An application registration
  3. C
    A system-assigned managed identity
  4. D
    A user-assigned managed identity

Answer

A service principal
A service principal is the local instance of a global application object in a specific Microsoft Entra ID tenant. It is created when consent is granted to the application, serving as the security identity that defines permissions and policies for the app within that tenant.

Step-by-Step Solution

1
Analyze the requirement for multi-tenant applications in Microsoft Entra ID.
The application needs a local representation in each tenant where it is consented to by an administrator.
To govern permissions and security configuration local to that customer's tenant.
2
Differentiate between application registration and service principal.
The application registration is the global template (in the home tenant), whereas the service principal is the local instance representing the application in a target tenant.
This determines which object is actually instantiated in the target customer tenant.
3
Exclude managed identities as options.
Managed identities are designed for Azure resources to authenticate to other Azure services, not for representing multi-tenant external SaaS apps.
Managed identities cannot be shared or instantiated dynamically in customer tenants through user/admin consent flows.

Key Concept

The relationship between Application Registrations (global template) and Service Principals (local tenant-specific instance) in Microsoft Entra ID.
Rate this question

Topics

App Registrations and Service Principals

More questions from this topic