Task 3.2: Plan, implement, and monitor the integration of enterprise applications

• AApplication proxy with header-based single sign-on, passing the user name in an HTTP header

  Incorrect

  Header-based SSO fits apps that read identity from headers, which this app doesn't.

• BA SAML-based enterprise application with the app's URL as the reply URL

  Incorrect

  The app doesn't support SAML, so it can't accept the token.

• CApplication proxy with Kerberos constrained delegation from the connector to the app's SPN

  Correct

  The connector impersonates the user with KCD to get a Kerberos ticket for the app.

• DApplication proxy with password-based SSO, storing each user's credentials for the app

  Incorrect

  Password-based SSO fills sign-in forms; an IWA app has no form to fill.

Application proxy supports SSO to apps secured with Integrated Windows Authentication by having the private network connector use Kerberos constrained delegation: Active Directory lets the connector impersonate the user and obtain a Kerberos ticket for the app's service principal name. The connector and app servers must be domain joined in the same or trusting domains.

• AUser consent set to Do not allow user consent

  Incorrect

  Users then can't consent to anything, including the low-impact permissions they're allowed.

• BUser consent set to Allow user consent for apps, for all permissions that don't need admin consent

  Incorrect

  This option lets users consent to any app, verified or not.

• CUser consent set to Allow user consent for apps from verified publishers, for selected permissions

  Correct

  This option limits user consent to verified or tenant apps and to permissions classified as low impact.

• DTenant-wide admin consent granted in advance for every app in the gallery

  Incorrect

  Granting consent ahead of time to every gallery app bypasses review entirely.

• EThe admin consent workflow with that group set as reviewers

  Correct

  Users who can't consent can then send a request to the designated reviewers.

The setting Allow user consent for apps from verified publishers, for selected permissions limits consent to apps from verified publishers and apps registered in the tenant, for permissions classified as low impact. The admin consent workflow lets users request consent for other apps, and designated reviewers approve or deny the requests.

• ARestart provisioning with the Clear current state option

  Incorrect

  Clearing state starts a full cycle for everyone in scope, not a single-user test.

• BA scoping filter that matches only the test user's UPN

  Incorrect

  A scoping filter limits who's in scope but still waits for the next cycle.

• CThe provisioning logs, filtered on the test user

  Incorrect

  The logs show what already happened in a cycle; they don't trigger a test.

• DProvision on demand for the test user

  Correct

  It runs provisioning for that one user immediately and shows each step's result.

On-demand provisioning provisions one user (or group) immediately, outside the regular cycle, and shows the import, scoping, matching and export steps with their results, which makes it the way to validate new attribute mappings before large cycles run.

• AHybrid Identity Administrator

  Incorrect

  This role manages hybrid identity components such as Connect and Cloud Sync, not app proxy settings on apps.

• BApplication Administrator

  Correct

  It manages all aspects of enterprise apps and app registrations, including application proxy settings.

• CGlobal Administrator

  Incorrect

  It can, but Application Administrator is less privileged and enough.

• DApplication Developer

  Incorrect

  It can't manage application proxy settings of existing enterprise applications.

Cloud Application Administrator can create and manage all aspects of app registrations and enterprise apps except application proxy. Application Administrator adds the application proxy settings, such as URLs and certificates, so it's the least privileged built-in role for publishing apps through application proxy.

• AEvery user in the tenant

  Incorrect

  Visibility in My Apps still depends on assignment.

• BOnly users and group members assigned to the app

  Correct

  Only assigned users see an app in My Apps, whether or not assignment is required.

• COnly Global Administrators

  Incorrect

  Administrators aren't the only ones who see assigned apps.

• DNobody, until the app is added to a collection

  Incorrect

  Collections are optional; assigned apps appear without them.

Regardless of the Assignment required setting, only assigned users see an application in My Apps. To let everyone use an app but show it only to some users, assign those users and set Assignment required to No.

• A90 days

  Incorrect

  The default validity is much longer.

• BOne year

  Incorrect

  The default validity is longer.

• CThree years

  Correct

  The generated certificate is valid for three years, and the expiration can be customized.

• DTen years

  Incorrect

  The default validity is shorter.

For a gallery app with SAML sign-on, Microsoft Entra ID generates a self-signed certificate valid for three years. You can customize the expiration and add email addresses for expiration notifications.

• AA collection, which needs Microsoft Entra ID P1 or P2

  Correct

  Collections group related apps on a separate My Apps tab.

• BAn app role named HR on each app, with Microsoft Entra ID P2

  Incorrect

  App roles grant permissions inside apps; they don't build My Apps tabs.

• CA dynamic group of HR apps, with Microsoft Entra ID P1

  Incorrect

  Groups contain users and devices, not apps.

• DAn administrative unit for HR apps, with Microsoft Entra ID Free

  Incorrect

  Administrative units scope admin roles; they don't organize My Apps.

Collections group related applications, for example by role or project, on a separate tab in My Apps. A collection filters the apps a user can already access, so users see only assigned apps in it. Creating collections needs Microsoft Entra ID P1 or P2.

• ALinked sign-on

  Correct

  Linked sign-on just points the tile to the app's URL and leaves sign-in to the app.

• BSAML-based single sign-on

  Incorrect

  SAML makes Microsoft Entra ID the identity provider for the app.

• CPassword-based single sign-on

  Incorrect

  Password SSO stores and fills credentials for the app.

• DOpenID Connect single sign-on

  Incorrect

  OIDC makes Microsoft Entra ID issue tokens for the app.

Linked sign-on adds a link to an application in My Apps and the Microsoft 365 launcher, while the application keeps its existing sign-in, for example another identity provider. Microsoft Entra ID doesn't provide SSO for it.