Microsoft Certified: Identity and Access Administrator AssociateImplement and manage workload identitiesEasy
A software development company is building a multi-tenant SaaS application that will be consumed by various customer organizations, each with its own Azure Active Directory tenant. The application needs to access Microsoft Graph to read user profiles in the customer's tenant after a customer administrator grants consent. Which type of application registration is required for this scenario?
- AMulti-tenant application registration.
- BSingle-tenant application registration.
- CPersonal Microsoft account only application registration.
- DAzure AD B2C application registration.
Show answer & explanationAnswer & explanation
Correct answer: A. Multi-tenant application registration.
A multi-tenant application registration allows an application to be used by users from any Azure AD tenant, enabling customers to sign in and consent to the application accessing their data. This is essential for SaaS applications serving multiple organizations.
Why the other options are wrong
- B. Single-tenant applications are designed for use only within the tenant where they are registered, not for multiple customer tenants.
- C. This option is for applications primarily targeting consumers with personal Microsoft accounts, not enterprise Azure AD tenants.
- D. Azure AD B2C is for customer-facing identity management (e.g., sign-up/sign-in for consumers), not for an application integrating with enterprise Azure AD tenants.
Multi-tenant Application Registration
An Azure AD application registration configured to allow users from any Azure AD tenant to sign in and grant consent for the application to access their tenant's resources.
- Enables SaaS applications to serve multiple organizations.
- Requires administrator consent for resource access in customer tenants.
- Configured by setting 'Supported account types' to 'Accounts in any organizational directory'.
Memory trick: Multi-tenant: One app, many homes, each tenant welcomes.