Examkin

Question

Difficulty: MediumMulti-tenant Applications Configuration

An application named App1 needs to be configured in Microsoft Entra ID. The application will be consumed by multiple external business partners who use their own corporate Entra ID directories, alongside external consultants who will sign in using their personal Microsoft accounts.

Which two configurations are required to support this authentication requirement? (Select two.)

  1. Set the signInAudience property in the application manifest to AzureADandPersonalMicrosoftAccountAnswer
  2. Use the common endpoint in the authority URI for user authenticationAnswer
  3. C
    Set the signInAudience property in the application manifest to AzureADMultipleOrgs
  4. D
    Use the organizations endpoint in the authority URI for user authentication

Answer

To support authentication for users from any corporate Entra ID tenant as well as personal Microsoft accounts, you must set the signInAudience property in the application manifest to AzureADandPersonalMicrosoftAccount and use the common endpoint in the authority URI for user authentication.
To support both multi-tenant organizational users and personal Microsoft accounts, the signInAudience parameter in the application manifest must be set to AzureADandPersonalMicrosoftAccount. In addition, the application's authentication configuration must point to the common endpoint (https://login.microsoftonline.com/common) because it routes both organizational and personal accounts, unlike the organizations endpoint which only routes organizational accounts.

Step-by-Step Solution

1
Identify the target user base requirements.
The application must support both multi-tenant organizational users (Entra ID) and personal accounts (Microsoft Accounts).
This determines the required directory audience and authentication endpoint configuration.
2
Choose the correct manifest sign-in audience.
Select AzureADandPersonalMicrosoftAccount.
The AzureADandPersonalMicrosoftAccount audience is designed specifically to allow logins from any Entra ID directory and personal Microsoft accounts.
3
Configure the authority endpoint in the application code.
Use the common endpoint (https://login.microsoftonline.com/common).
The common endpoint routes requests dynamically for both organizational accounts and personal Microsoft accounts, whereas the organizations endpoint restricts access to organizational accounts only.

Key Concept

Configuring multi-tenant Microsoft Entra ID applications to support both organizational accounts and personal Microsoft accounts.
Rate this question

Topics

Multi-tenant Applications Configuration

More questions from this topic