You have an Azure Active Directory (Azure AD) tenant. You need to prevent nonprivileged Azure AD users from creating service principles in Azure AD. What should you do in the Azure Active Directory…

Question

Options

• AFrom the User settings blade, set Users can register applications to No.
• BFrom the Properties blade, set Access management for Azure resources to No.
• CFrom the User settings blade, set Restrict access to Azure AD administration portal to Yes.
• DFrom the Properties blade, set Enable Security defaults to Yes.

• A
  77% (30)
• B
  5% (2)
• C
  13% (5)
• D
  5% (2)

Explanation

Explanation

Setting "Users can register applications" to No in the User Settings blade directly controls whether non-privileged users can create app registrations, which is the mechanism by which service principals are created in Azure AD - disabling this restricts that capability to administrators only.

Why the distractors are wrong:

• Option B ("Access management for Azure resources") controls whether a Global Admin can manage access to Azure subscriptions and resources, not service principal creation.
• Option C (Restricting the Azure AD administration portal) only blocks access to the portal interface - users can still create service principals via PowerShell, CLI, or APIs, so it doesn't truly prevent the action.
• Option D (Security Defaults) enables a predefined set of baseline security policies like MFA enforcement, but it has no specific setting to block service principal creation.

Memory Tip: Think of "register applications" as the front door to service principals - an app registration creates a service principal behind the scenes. If users can't register apps, they can't create service principals. The phrase "register applications = service principals" should stick as a reliable association for exam questions on this topic.

No community discussion yet for this question.