A developer is implementing a partner integration service that authenticates users across several external enterprise clients using Microsoft Entra ID. The configuration must allow sign-ins from any corporate directory but must explicitly block users signing in with personal Microsoft accounts.
Which combination of the `signInAudience` value in the application manifest and the OAuth 2.0 authorization endpoint must be configured?
- ASet `signInAudience` to `AzureADMultipleOrgs` and use the `https://login.microsoftonline.com/common/oauth2/v2.0/authorize` endpoint.
- Set `signInAudience` to `AzureADMultipleOrgs` and use the `https://login.microsoftonline.com/organizations/oauth2/v2.0/authorize` endpoint.Answer
- CSet `signInAudience` to `AzureADandPersonalMicrosoftAccount` and use the `https://login.microsoftonline.com/common/oauth2/v2.0/authorize` endpoint.
- DSet `signInAudience` to `AzureADMyOrg` and use the `https://login.microsoftonline.com/organizations/oauth2/v2.0/authorize` endpoint.
Answer
Set `signInAudience` to `AzureADMultipleOrgs` and use the `https://login.microsoftonline.com/organizations/oauth2/v2.0/authorize` endpoint.
The correct configuration is to set `signInAudience` to `AzureADMultipleOrgs` and use the `/organizations` endpoint. The `AzureADMultipleOrgs` value limits the sign-in audience to work or school accounts from any Microsoft Entra ID tenant, excluding personal accounts. Using the `/organizations` endpoint ensures that the authentication flow restricts user discovery and entry to organizational directories only.
Step-by-Step Solution
Key Concept
Configuring multi-tenant Microsoft Entra ID application registration properties and authority endpoints to control user sign-in audience.