📖 What is Microsoft Entra ID Enterprise Applications?
Microsoft Entra ID Enterprise Applications are objects that represent a service principal for a specific application, enabling administrators to manage single sign-on (SSO) and permission assignments. They act as the identity of the application within the tenant to control access to resources.
"Remember the distinction: App Registrations are for the developer creating the app, while Enterprise Applications are for the admin managing the app's deployment."
📚 Certification: Microsoft 365 Administrator (MS-102)
🔑 What are the Key Concepts of Microsoft Entra ID Enterprise Applications?
- ▸ Service Principals act as the local identity for an application within a tenant, allowing admins to assign permissions and manage access controls.
- ▸ Single Sign-On (SSO) configuration allows admins to integrate third-party SaaS applications using SAML or OIDC for seamless user authentication.
- ▸ User and group assignments enable granular access control, ensuring only authorized identities can sign into specific enterprise applications.
- ▸ Admin consent allows a global administrator to grant permissions for an application on behalf of all users, streamlining the onboarding process.
- ▸ Conditional Access integration allows admins to enforce security requirements, such as MFA, specifically when users attempt to access an enterprise application.
🎯 How does Microsoft Entra ID Enterprise Applications appear on the MS-102 Exam?
You may be asked to configure a third-party SaaS application for SSO. The scenario will require you to identify where to upload the metadata file and assign specific user groups.
A scenario might describe a requirement to prevent users from consenting to risky applications. You will need to navigate to Enterprise Applications to modify the user consent settings.
Expect questions regarding the lifecycle of an application where a developer creates an App Registration, but the administrator must manage the resulting Enterprise Application to assign users and permissions.
❓ Frequently Asked Questions
What is the difference between 'Assignment required' being set to Yes versus No?
When set to Yes, only users or groups explicitly assigned to the application can access it. When set to No, any user in the tenant can sign in, provided they have the necessary permissions.
Can an Enterprise Application exist without a corresponding App Registration in the same tenant?
Yes. Multi-tenant applications are registered in one home tenant but create a separate Enterprise Application (service principal) in every guest tenant where they are installed.