Examkin

Question

Difficulty: Very hardApp Registrations and Service Principals

Your company has developed a multi-tenant software-as-a-service (SaaS) application registered in Microsoft Entra Tenant A. Several client organizations, including Tenant B, have consented to the application, which created a service principal for the application in each customer tenant. The application runs as a background daemon service and uses the client credentials flow with a client secret to access APIs in each customer's tenant. You need to rotate the client secret without causing service interruption or requiring the customers' administrators to perform any actions. Which of the following is the correct way to rotate the secret?

  1. Configure the new client secret on the application registration in Tenant A, update the daemon service to use the new secret, and then delete the expired secret from the application registration in Tenant A.Answer
  2. B
    Create a new client secret on the service principal in Tenant B, update the daemon service instance targeting Tenant B with this new secret, and delete the old secret from the service principal in Tenant B.
  3. C
    Ask the Tenant B administrator to generate a new client secret on the consented service principal in Tenant B, retrieve the secret value, and update the daemon service configuration.
  4. D
    Add a new client secret in the application registration in Tenant A, then request the Tenant B administrator to re-consent to the application so that the service principal in Tenant B synchronizes and registers the new secret.

Answer

Configure the new client secret on the application registration in Tenant A, update the daemon service to use the new secret, and then delete the expired secret from the application registration in Tenant A.
In a multi-tenant Microsoft Entra ID scenario, the global Application object (managed via the App Registration in the home tenant) holds the authentication credentials (secrets/certificates). The local Service Principals created in consumer tenants reference the global application object for authentication checks. To rotate credentials without downtime, you add a new secret to the App Registration in the home tenant, update your service to use it, and delete the old secret. No updates or admin intervention are required in the customer tenants.

Step-by-Step Solution

1
Locate the application registration in the home tenant (Tenant A) where the multi-tenant app is registered.
Access to the global Application object configuration is obtained.
Credentials for multi-tenant applications are managed globally on the Application object, not on individual local service principals.
2
Generate a new client secret under the Certificates & secrets section of the application registration.
A new client secret value is created and becomes active immediately.
Adding a second secret allows the application to authenticate using either the old or new secret, preventing downtime during transition.
3
Update the daemon service configuration to use the new client secret value when requesting tokens.
The daemon service successfully acquires tokens for Tenant B and other customer tenants using the new secret.
Microsoft Entra ID resolves token requests by validating the provided secret against the application object in Tenant A, even when requesting tokens for Tenant B.
4
Remove the old client secret from the application registration in Tenant A.
The old client secret is revoked and can no longer be used for authentication.
Deleting the old secret ensures proper security hygiene and completes the rotation process.

Key Concept

Multi-tenant application credentials management and the relationship between Application objects (App Registrations) and Service Principals.

Alternative Method

Instead of using client secrets, you can upload a client certificate to the application registration in Tenant A. For production environments, authenticating via a certificate stored securely in Azure Key Vault is the recommended practice for rotation and security compliance.
Estimated Time:3m 0s
Rate this question

Topics

App Registrations and Service Principals

More questions from this topic