Examkin

Question

Difficulty: Very hardMulti-tenant Applications Configuration

You are developing a multi-tenant SaaS application that will be distributed to various corporate clients. The application requires access to the Microsoft Graph API.

You have the following requirements:
1. Users from any Microsoft Entra ID tenant must be able to sign in to the application.
2. Personal Microsoft accounts (such as Skype, Outlook.com, or Xbox Live) must be prevented from signing in.
3. A tenant administrator must be able to grant consent to the application's required permissions for all users in their tenant.

You need to configure the application registration and endpoints.

Which two actions should you perform? (Each correct answer presents part of the solution.)

  1. In the application manifest, set the `signInAudience` property to `AzureADMultipleOrgs`.Answer
  2. B
    Configure the application's user sign-in endpoint to target `https://login.microsoftonline.com/common/oauth2/v2.0/authorize`.
  3. Configure the application's user sign-in endpoint to target `https://login.microsoftonline.com/organizations/oauth2/v2.0/authorize`.Answer
  4. D
    Construct the admin consent URL using the `/organizations` tenant placeholder, such as `https://login.microsoftonline.com/organizations/v2.0/adminconsent`.

Answer

To configure the multi-tenant application to allow only organizational directories and block personal accounts, set the `signInAudience` property to `AzureADMultipleOrgs` in the application manifest and configure the user sign-in endpoint to target the `/organizations` authorize endpoint.
Configuring the application manifest with a `signInAudience` of `AzureADMultipleOrgs` specifies that the app supports accounts in any organizational directory. Pairing this with the `/organizations` authorize endpoint ensures that only work or school accounts are accepted during authentication, effectively blocking personal Microsoft accounts. Together, these steps satisfy the multi-tenant requirements while enforcing the exclusion of personal accounts.

Step-by-Step Solution

1
Select the correct `signInAudience` in the application manifest.
Setting `signInAudience` to `AzureADMultipleOrgs` enables multi-tenant support for organizational directories only.
This excludes personal Microsoft accounts at the application registration level.
2
Determine the appropriate sign-in endpoint for user authentication.
Using `https://login.microsoftonline.com/organizations/oauth2/v2.0/authorize` restricts incoming authentication requests to organizational tenants.
The `/common` endpoint would allow personal Microsoft accounts to authenticate, violating the requirement to exclude them.
3
Understand the requirements of the admin consent endpoint.
Constructing the admin consent URL requires a specific tenant ID or domain name instead of a generic placeholder like `/organizations`.
Microsoft Entra ID requires an explicit target directory to record the tenant-wide admin consent.

Key Concept

Microsoft Entra ID multi-tenant application endpoint configuration and manifest properties
Rate this question

Topics

Multi-tenant Applications Configuration

More questions from this topic