SC-100 Certification Practice Question #249

Question

You have a Microsoft Entra tenant named contoso.com.

You have a partner company that has a multi-tenant application named App1. App1 is registered to a Microsoft Entra tenant named fabrikam.com.

You need to ensure that the users in contoso.com can authenticate to App1.

What should you recommend creating in contoso.com?

Accepted Answer

App1 is a multi-tenant application registered (its application object) in fabrikam.com. For contoso.com users to authenticate to it, contoso.com needs a local representation of App1 — a service principal (enterprise application) — which is created when an admin/user grants consent. MS Learn states a multi-tenant application "requires a service principal in each tenant… created when a user from that tenant consents," matching the scenario exactly. The application object (C) exists only in the app's home tenant (fabrikam.com) and is not re-created in contoso.com, so the dissenting C vote is incorrect. Managed identities (B, D) represent Azure resources calling other services, not external users signing in to a partner SaaS app, so they are eliminated. Suggested Answer, the 7-vote Most Voted, and two well-reasoned comments all align on A.

More SC-100 practice questions