Examkin

Soru

Zorluk: ZorMulti-tenant Applications Configuration

An organization is deploying a multi-tenant web application named App1 to Azure App Service. App1 needs to authenticate users from any Microsoft Entra ID tenant but must restrict access to corporate (work or school) accounts only, preventing personal Microsoft accounts from signing in. You are configuring the application registration manifest and the authentication authority endpoint in the application code.

Which of the following configurations should you apply to satisfy these requirements?

  1. Set the signInAudience parameter to AzureADMultipleOrgs and use the authority endpoint https://login.microsoftonline.com/organizationsCevap
  2. B
    Set the signInAudience parameter to AzureADandPersonalMicrosoftAccount and use the authority endpoint https://login.microsoftonline.com/common
  3. C
    Set the signInAudience parameter to AzureADMultipleOrgs and use the authority endpoint https://login.microsoftonline.com/common
  4. D
    Set the signInAudience parameter to AzureADMyOrg and use the authority endpoint https://login.microsoftonline.com/organizations

Cevap

Set the signInAudience parameter to AzureADMultipleOrgs and use the authority endpoint https://login.microsoftonline.com/organizations
The correct configuration is to set the signInAudience to AzureADMultipleOrgs and use the /organizations authority endpoint. This ensures the application accepts authentication requests only from organizational (work or school) directories across any tenant while preventing personal Microsoft accounts from signing in.

Adım Adım Çözüm

1
Analyze the tenant requirement
The application must support users from multiple external Microsoft Entra ID tenants, meaning a multi-tenant configuration is required.
Single-tenant configuration (AzureADMyOrg) will restrict logins to a single tenant.
2
Select the correct signInAudience
Choose AzureADMultipleOrgs instead of AzureADandPersonalMicrosoftAccount.
The requirement explicitly states that personal accounts must be blocked. AzureADMultipleOrgs targets only corporate accounts across tenants.
3
Select the correct authority endpoint
Use the /organizations endpoint instead of the /common endpoint.
The /organizations endpoint restricts sign-in requests to organizational accounts only, whereas the /common endpoint accepts both organizational and personal accounts.

Anahtar Kavram

Configuring multi-tenant Microsoft Entra ID applications with appropriate sign-in audiences and authorization endpoints.
Tahmini Süre:2m 0s
Bu soruyu puanla

Konular

Multi-tenant Applications Configuration

Bu konudan daha fazla soru