Examkin

Question

Difficulty: MediumMulti-tenant Applications Configuration

A development team is configuring a new collaboration portal registered in Microsoft Entra ID. The portal must allow users from any corporate or academic Microsoft Entra ID tenant to authenticate, while strictly blocking personal Microsoft Accounts (such as Xbox, Skype, or Outlook.com accounts).

Which combination of application manifest settings and token authority endpoints should the team implement?

  1. Set the signInAudience parameter to AzureADMultipleOrgs and use the https://login.microsoftonline.com/organizations endpoint.Answer
  2. B
    Set the signInAudience parameter to AzureADandPersonalMicrosoftAccount and use the https://login.microsoftonline.com/common endpoint.
  3. C
    Set the signInAudience parameter to AzureADMyOrg and use the https://login.microsoftonline.com/organizations endpoint.
  4. D
    Set the signInAudience parameter to AzureADMultipleOrgs and use the https://login.microsoftonline.com/common endpoint.

Answer

Set the signInAudience parameter to AzureADMultipleOrgs and use the https://login.microsoftonline.com/organizations endpoint.
Setting signInAudience to AzureADMultipleOrgs allows sign-in by users with work or school accounts from any Microsoft Entra ID tenant. Using the /organizations endpoint ensures that only users from organizational directories are allowed to authenticate, which effectively blocks personal Microsoft accounts (MSA) like Outlook.com, Skype, or Xbox Live from logging in.

Step-by-Step Solution

1
Identify the tenant requirement for the multi-tenant application.
The application needs to accept work and school accounts from any tenant but reject personal accounts.
This defines the target audience scope.
2
Configure the signInAudience parameter in the application registration manifest.
Set the signInAudience parameter to AzureADMultipleOrgs.
AzureADMultipleOrgs allows any organizational directory but excludes personal accounts at the manifest registration level.
3
Select the correct token authority endpoint for authentication requests.
Route requests to the /organizations endpoint.
The /organizations endpoint restricts authentication specifically to organizational accounts, preventing personal accounts from obtaining tokens, unlike the /common endpoint which permits both.

Key Concept

Multi-tenant Applications Configuration
Estimated Time:1m 30s
Rate this question

Topics

Multi-tenant Applications Configuration

More questions from this topic