Examkin

Soru

Zorluk: KolayApp Registrations and Service Principals

A developer registers a multitenant web application in their organization's Microsoft Entra ID tenant. When a user from a different organization consents to use the application, which object is automatically created in that user's tenant to represent the application instance and manage its local permissions?

  1. A service principalCevap
  2. B
    A secondary app registration
  3. C
    A system-assigned managed identity
  4. D
    A Shared Access Signature token

Cevap

A service principal
The correct answer is the option stating a service principal. When an application is registered in Microsoft Entra ID, an application object is created in the home tenant. However, to allow the application to execute and access resources in other tenants (such as when an external user consents), Microsoft Entra ID creates a service principal in the user's tenant. This service principal represents the local instance of the application and is used to assign permissions and roles locally.

Adım Adım Çözüm

1
Analyze the scenario of registering a multitenant application and consenting users from other tenants.
Identify that the application registration acts as the global definition, but each tenant needs a local representation to manage access.
Microsoft Entra ID separates the application's global configuration from its local instance details.
2
Determine the object type that represents this local instance.
A service principal object is created in the consenting tenant to act as the identity for the application instance.
The service principal governs the actual security token issuance and resource access permissions within that specific tenant.

Anahtar Kavram

Difference between App Registrations and Service Principals in multitenant environments
Bu soruyu puanla

Konular

App Registrations and Service Principals

Bu konudan daha fazla soru