Examkin

Question

Difficulty: MediumMulti-tenant Applications Configuration

A developer is configuring a multi-tenant web application named AppRegister in Microsoft Entra ID. The application must allow users from any organizational tenant to authenticate. However, the application must prevent users with personal Microsoft accounts (MSA) from signing in. Which two configurations should the developer implement to meet these requirements?

  1. Set the signInAudience parameter in the application manifest to AzureADMultipleOrgs.Answer
  2. B
    Set the signInAudience parameter in the application manifest to AzureADandPersonalMicrosoftAccount.
  3. Configure the application to direct authentication requests to the /organizations endpoint.Answer
  4. D
    Configure the application to direct authentication requests to the /common endpoint.

Answer

Setting the signInAudience parameter in the application manifest to AzureADMultipleOrgs and directing authentication requests to the /organizations endpoint.
To configure a multi-tenant application that supports only work or school accounts from any organization and excludes personal Microsoft accounts, the signInAudience parameter in the application manifest must be set to AzureADMultipleOrgs. Additionally, the application must send authorization requests to the /organizations endpoint. The /common endpoint and the AzureADandPersonalMicrosoftAccount audience value would allow personal Microsoft accounts to authenticate, which violates the requirement.

Step-by-Step Solution

1
Identify the audience requirement for the application registration.
The application must allow any organization's tenant but exclude personal Microsoft accounts.
This filters out single-tenant settings and configurations that permit personal accounts.
2
Select the correct signInAudience value in the manifest.
AzureADMultipleOrgs must be selected.
AzureADMultipleOrgs supports multiple organizational tenants and explicitly excludes personal accounts, unlike AzureADandPersonalMicrosoftAccount.
3
Select the correct Microsoft Entra ID authorization endpoint.
The /organizations endpoint must be chosen.
The /organizations endpoint restricts login to work or school accounts, whereas the /common endpoint permits personal accounts.

Key Concept

Multi-tenant Applications Configuration
Rate this question

Topics

Multi-tenant Applications Configuration

More questions from this topic