You have a Microsoft Entra tenant named contoso.com. You have a partner company that has a multi-tenant application named App1. App1 is registered to a Microsoft Entra tenant named fabrikam.com. You…

Question

Options

• Aa service principal
• Ba system-assigned managed identity
• Can application object
• Da user-assigned managed identity

• A
  93% (13)
• D
  7% (1)

Explanation

In Microsoft Entra ID, there is a distinction between an application object and a service principal. An application object is the global definition of an app and exists only in the tenant where the app was registered - in this case, fabrikam.com. A service principal is the local representation of that app in each tenant where it is used. When a multi-tenant application like App1 (registered in fabrikam.com) needs to be accessible to users in another tenant (contoso.com), a service principal must be created in contoso.com. This typically happens when a Global Administrator in contoso.com grants admin consent to the application, which instantiates the service principal and allows users in that tenant to authenticate. Managed identities (B and D) are used to give Azure resources an identity to access other Azure services - they are not relevant here. An application object (C) would be incorrect because you do not re-register the app in contoso.com; the app object stays in fabrikam.com.

No community discussion yet for this question.