Question

Difficulty: MediumApp Registrations and Service Principals

You are developing a multi-tenant web application named App1 that will be registered in Microsoft Entra ID under Tenant A. Users from other Microsoft Entra ID tenants, such as Tenant B, must be able to sign in to App1 and grant the application permissions to read their profile data.

You need to understand how the identity objects are represented in the directory structure when a user from Tenant B consents to App1.

Which of the following describes the resource creation behavior in Tenant B?

  1. A service principal is created in Tenant B that references the application object in Tenant A.Answer
  2. B
    A user-assigned managed identity is automatically created in Tenant B to manage the cross-tenant authorization lifecycle.
  3. C
    A system-assigned managed identity is automatically created in Tenant B to authenticate the application and consent flow.
  4. D
    A key vault access policy is created in Tenant B to grant the application registration in Tenant A permissions to access Tenant B directory resources.

Answer

A service principal is created in Tenant B that references the application object in Tenant A.
The correct answer is correct because in Microsoft Entra ID, the application registration generates a global application object in the home tenant. When the application is made multi-tenant and consented to by a user in another tenant, a local service principal (enterprise application) is created in that target tenant to represent the application and hold its local permissions.

Step-by-Step Solution

1
Understand the difference between application objects and service principals in Microsoft Entra ID.
The application object is the global definition of the application, while the service principal is the local instance or representation of that application within a specific tenant.
This conceptual distinction is fundamental to understanding how multi-tenant applications operate and are authorized across tenant boundaries.
2
Analyze the lifecycle of a multi-tenant application consent flow.
When a user in Tenant B consents to the application registered in Tenant A, Microsoft Entra ID creates a service principal in Tenant B pointing back to the application object in Tenant A.
This establishes the security principal in Tenant B to which permissions and roles can be assigned locally.

Key Concept

The relationship between application objects (global definition) and service principals (local instance) in multi-tenant environments.
Rate this question