Examkin

Soru

Zorluk: OrtaMulti-tenant Applications Configuration

You are configuring a multi-tenant web application registration in Microsoft Entra ID. The application must allow users from any organizational Microsoft Entra ID tenant to sign in, but it must explicitly block users signing in with personal Microsoft accounts (such as outlook.com or hotmail.com). Which two configurations should you implement to satisfy this requirement? (Select two)

  1. Set the signInAudience parameter in the application manifest to AzureADMultipleOrgsCevap
  2. Configure the authority endpoint in the application code to use the /organizations tenant placeholderCevap
  3. C
    Set the signInAudience parameter in the application manifest to AzureADandPersonalMicrosoftAccount
  4. D
    Configure the authority endpoint in the application code to use the /common tenant placeholder

Cevap

To configure a multi-tenant application to accept only organizational accounts while excluding personal accounts, you must set the signInAudience parameter to AzureADMultipleOrgs in the manifest and route authentication requests to the /organizations endpoint.
To limit access strictly to work or school accounts across any Microsoft Entra ID tenant, the application manifest must define the sign-in audience as AzureADMultipleOrgs. Correspondingly, client applications must request authorization from the /organizations endpoint to prevent personal accounts from being evaluated.

Adım Adım Çözüm

1
Select the appropriate sign-in audience for organizational accounts.
The signInAudience property in the application registration manifest must be set to AzureADMultipleOrgs.
This configuration allows users from any Entra ID tenant (work or school accounts) to authenticate while blocking personal Microsoft accounts.
2
Determine the correct authorization authority endpoint.
The authority URL must use the /organizations endpoint instead of /common.
The /organizations endpoint restricts authentication to Entra ID organizational tenants only, whereas /common would also allow personal Microsoft accounts.

Anahtar Kavram

Configuring multi-tenant sign-in audiences and authority endpoints in Microsoft Entra ID
Tahmini Süre:1m 30s
Bu soruyu puanla

Konular

Multi-tenant Applications Configuration

Bu konudan daha fazla soru