You are developing a multi-tenant web application named App1 that will be registered in Microsoft Entra ID under Tenant A. Users from other Microsoft Entra ID tenants, such as Tenant B, must be able to sign in to App1 and grant the application permissions to read their profile data.
You need to understand how the identity objects are represented in the directory structure when a user from Tenant B consents to App1.
Which of the following describes the resource creation behavior in Tenant B?
- A service principal is created in Tenant B that references the application object in Tenant A.Answer
- BA user-assigned managed identity is automatically created in Tenant B to manage the cross-tenant authorization lifecycle.
- CA system-assigned managed identity is automatically created in Tenant B to authenticate the application and consent flow.
- DA key vault access policy is created in Tenant B to grant the application registration in Tenant A permissions to access Tenant B directory resources.
Answer
A service principal is created in Tenant B that references the application object in Tenant A.
The correct answer is correct because in Microsoft Entra ID, the application registration generates a global application object in the home tenant. When the application is made multi-tenant and consented to by a user in another tenant, a local service principal (enterprise application) is created in that target tenant to represent the application and hold its local permissions.
Step-by-Step Solution
Key Concept
The relationship between application objects (global definition) and service principals (local instance) in multi-tenant environments.