Hotspot Question You have an Azure subscription that uses Microsoft Entra Permissions Management. You have an Amazon Web Services (AWS) account. You plan to connect Permissions Management to AWS. You

The correct answer is First part of the PowerShell command: New-AzureADApplication; Parameter before "api://mciem-aws-oidc-app": -IdentifierUrls. This question tests knowledge of how to register a Microsoft Entra Permissions Management application using PowerShell to enable integration with AWS. The correct PowerShell command uses the Microsoft Graph or Azure AD module to create the required service principal for Permissio

Submitted by marco_it· Mar 6, 2026Plan and implement workload identities

Question

Hotspot Question You have an Azure subscription that uses Microsoft Entra Permissions Management. You have an Amazon Web Services (AWS) account. You plan to connect Permissions Management to AWS. You need to create a Permissions Management app in Azure. How should you complete the PowerShell command? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point. Answer:

Answer Area

First part of the PowerShell commandNew-AzureADApplication
New-AzureADApplicationNew-AzureADApplicationExtensionPropertyNew-AzureADApplicationKeyCredential
Parameter before "api://mciem-aws-oidc-app"-IdentifierUrls
-GroupMembershipClaims-IdentifierUrls-InformationalUrls-KeyCredentials

Explanation

This question tests knowledge of how to register a Microsoft Entra Permissions Management application using PowerShell to enable integration with AWS. The correct PowerShell command uses the Microsoft Graph or Azure AD module to create the required service principal for Permissions Management.

Approach. To connect Microsoft Entra Permissions Management to AWS, you must create an app registration in Azure using PowerShell. The correct command is: New-AzureADServicePrincipal -AppId 'b46c3ac5-9da6-418f-a849-0a07a10b3c6c' - where the AppId corresponds to the well-known Permissions Management application ID (Cloud Infrastructure Entitlement Management). The cmdlet New-AzureADServicePrincipal is used (not New-AzureADApplication) because you are instantiating an existing multi-tenant Microsoft application into your tenant as a service principal, not creating a brand-new app registration. The specific AppId b46c3ac5-9da6-418f-a849-0a07a10b3c6c is the globally unique identifier for the Permissions Management (CIEM) service that Microsoft publishes, and using it ensures the correct app is provisioned in your Azure AD tenant to facilitate the AWS onboarding workflow.

Concept tested. Registering the Microsoft Entra Permissions Management (CIEM) service principal in an Azure AD tenant using the correct PowerShell cmdlet (New-AzureADServicePrincipal) and the correct well-known Application ID for the Permissions Management service, as required before connecting to AWS cloud environments.

Reference. https://learn.microsoft.com/en-us/azure/active-directory/cloud-infrastructure-entitlement-management/onboard-aws

Topics

#Entra Permissions Management#AWS integration#PowerShell#app registration

Community Discussion

No community discussion yet for this question.

Full SC-300 Practice