A software-as-a-service (SaaS) provider registers a multi-tenant web application in their home Microsoft Entra ID tenant (Tenant A). An enterprise customer (Tenant B) successfully consents to the application, allowing their users to log in. The SaaS provider now needs to grant this application read access to an Azure SQL Database located in Tenant B. Which identity object in Tenant B must be assigned the database permissions?
- AThe application object created in Tenant B during the consent process
- BThe global application object registered in Tenant A
- The service principal object created in Tenant B that references the application object in Tenant ACevap
- DA user-assigned managed identity in Tenant B mapped to the application registration
Cevap
The service principal object created in Tenant B that references the application object in Tenant A
The correct answer is the service principal object created in Tenant B. In Microsoft Entra ID, the application object is the global definition of the application, which is created only in the home tenant (Tenant A). When a user or administrator in Tenant B consents to the application, a service principal (also called an enterprise application) is created in Tenant B. To grant the application access to resources in Tenant B, you must assign permissions to this local service principal.
Adım Adım Çözüm
Anahtar Kavram
Multi-tenant application architecture requires a local service principal in the consumer tenant to assign permissions to resources in that tenant.