Microsoft Certified: Identity and Access Administrator AssociateImplement and manage workload identitiesMedium
An organization uses Azure AD for identity management. A new SaaS application, 'DocuSign', needs to be integrated with Azure AD for single sign-on (SSO) and user provisioning. The application is already pre-integrated by Microsoft and supports SAML-based SSO. Which type of workload identity object should be configured in Azure AD to facilitate this integration?
- ASystem-assigned managed identity
- BUser-assigned managed identity
- CAzure AD application registration
- DEnterprise application
Show answer & explanationAnswer & explanation
Correct answer: D. Enterprise application
When integrating pre-built SaaS applications like DocuSign for SSO and provisioning, an 'Enterprise application' object is created in Azure AD. This object represents the service principal for the SaaS application within your tenant, allowing you to configure its properties like SSO settings and user assignments.
Why the other options are wrong
- A. Managed identities are for Azure resources to authenticate to other Azure services, not for integrating external SaaS applications.
- B. Managed identities are for Azure resources to authenticate to other Azure services, not for integrating external SaaS applications.
- C. While an Enterprise Application is backed by a service principal, which is derived from an application registration (often global for SaaS apps), the direct object you configure for SaaS integration in your tenant is the Enterprise Application.
Azure AD Enterprise Application
An object in Azure AD that represents an instance of a service principal in your tenant, often used for configuring SSO and provisioning with pre-integrated SaaS applications.
- Represents an instance of an application/service principal in a specific tenant.
- Used for configuring SSO (SAML, OIDC) and user provisioning for SaaS apps.
- Found under 'Enterprise applications' in the Azure portal.
- Can be linked to a gallery app or a custom non-gallery app.
Memory trick: Enterprise App: Your tenant's gateway to external SaaS services.