Examkin

Soru

Zorluk: OrtaMulti-tenant Applications Configuration

An organization is developing a multi-tenant software solution named VendorPortal. The solution must allow users from any organizational Microsoft Entra ID tenant to sign in. The solution must explicitly block authentication requests from personal Microsoft accounts, such as those registered with Outlook.com or Xbox Live. Which configuration parameters should you apply to the application manifest and the identity provider authority URL?

  1. A
    Manifest signInAudience set to AzureADMyOrg and authority URL set to https://login.microsoftonline.com/organizations
  2. B
    Manifest signInAudience set to AzureADandPersonalMicrosoftAccount and authority URL set to https://login.microsoftonline.com/common
  3. Manifest signInAudience set to AzureADMultipleOrgs and authority URL set to https://login.microsoftonline.com/organizationsCevap
  4. D
    Manifest signInAudience set to AzureADMultipleOrgs and authority URL set to https://login.microsoftonline.com/common

Cevap

Manifest signInAudience set to AzureADMultipleOrgs and authority URL set to https://login.microsoftonline.com/organizations
To configure a multi-tenant application that supports only organizational directories and blocks personal Microsoft accounts, the developer must set the signInAudience in the application manifest to AzureADMultipleOrgs. Additionally, the authority URL must point to the organizations endpoint. Using the organizations endpoint ensures that personal accounts are blocked at the identity provider sign-in page before they can input credentials.

Adım Adım Çözüm

1
Determine the required user audience scope for the application.
The application must support users from any organization (multi-tenant) but exclude personal Microsoft accounts.
This establishes the target audience profile for the manifest configuration.
2
Select the appropriate signInAudience value in the Microsoft Entra ID application manifest.
Identify that AzureADMultipleOrgs is the correct setting for multi-tenant organizations without personal accounts.
AzureADMultipleOrgs enables multi-tenant support while excluding personal accounts (which would require AzureADandPersonalMicrosoftAccount).
3
Configure the authority endpoint to match the tenant restriction requirements.
Select the /organizations endpoint (https://login.microsoftonline.com/organizations) instead of /common.
The /organizations endpoint restricts sign-in attempts to organizational directories, preventing personal accounts from proceeding at the protocol level.

Anahtar Kavram

Configuring multi-tenant authorization endpoints and application manifest audiences in Microsoft Entra ID.
Tahmini Süre:1m 30s
Bu soruyu puanla

Konular

Multi-tenant Applications Configuration

Bu konudan daha fazla soru