When implementing authentication and authorization in Microsoft Entra ID, developers must understand the relationships between different identity objects. Which two of the following statements correctly describe the characteristics or roles of application objects and service principals?
- The application object serves as the global definition of the application and remains in the tenant where the application was registered.Cevap
- A service principal is the local representation of the application object in a specific tenant and is used to define access policies and permissions.Cevap
- CA system-assigned managed identity is automatically created as part of the standard application registration process to act as the service principal.
- DTo enable programmatic access for an application running on an on-premises server, you must assign a user-assigned managed identity to the application registration.
Cevap
The correct statements are that the application object serves as the global definition of the application and remains in the tenant where the application was registered, and a service principal is the local representation of the application object in a specific tenant used to define access policies and permissions.
The statement about the application object serving as the global definition in the home tenant is correct because the application object defines the application's configuration globally. The statement about the service principal being the local instance is correct because the service principal acts as the security identity (instance) in each tenant to enforce access policies.
Adım Adım Çözüm
Anahtar Kavram
The relationship and differences between application objects, service principals, and managed identities in Microsoft Entra ID.