AZ-204 Implement Azure security Practice Question
You are configuring an Azure App Service web app to authenticate users with Microsoft Entra ID. You need to ensure that only users from your organization's tenant can access the app. Which setting should you configure?
⚠ Common exam trap
Test-takers frequently confuse the Issuer URL with the Client ID or Allowed token audiences, thinking that setting the Client ID alone will restrict access to a specific tenant, when in fact it only identifies the app, not the tenant.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Set the Issuer URL to https://login.microsoftonline.com/{tenant-id}/v2.0
Setting the Issuer URL to `https://login.microsoftonline.com/{tenant-id}/v2.0` restricts token validation to only tokens issued by your specific Microsoft Entra ID tenant. This ensures that only users from your organization's tenant can authenticate, as the app will reject tokens from other tenants or the common endpoint.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Set the Issuer URL to https://login.microsoftonline.com/common/v2.0
Why it's wrong here
Setting the Issuer URL to https://login.microsoftonline.com/common/v2.0 explicitly configures the application to accept authentication requests from *any* Azure AD tenant. The 'common' endpoint is designed for multi-tenant applications, allowing users from various organizations to sign in, with Azure AD dynamically routing the authentication to their respective home tenants. Consequently, this configuration would enable users from *any* tenant to authenticate, directly contradicting the goal of restricting access to a *specific* tenant.
- ✗
Set the Client ID to the application's Application ID.
Why it's wrong here
Configuring the Client ID (also known as Application ID) to the application's unique identifier is a fundamental step for any Azure AD integrated application, as it identifies the specific client requesting authentication tokens. However, the Client ID's role is solely to identify the application itself to the authentication service, not to enforce tenant-level restrictions. It does not contain information about which tenant is permitted to authenticate, making it ineffective for restricting access to a single, designated tenant.
- ✗
Set the Allowed token audiences to include the app's Application ID URI.
Why it's wrong here
Including the application's Application ID URI in the Allowed token audiences ensures that received tokens are validated as intended for *this specific application*. The 'aud' (audience) claim in a security token specifies the resource or recipient for which the token is intended, preventing tokens from being misused by unintended parties. While crucial for token validation and security, this setting does not filter users based on their originating Azure AD tenant, as a token from any tenant could still have the correct audience if issued for your application.
- ✓
Set the Issuer URL to https://login.microsoftonline.com/{tenant-id}/v2.0
Why this is correct
Setting the Issuer URL to https://login.microsoftonline.com/{tenant-id}/v2.0 is the correct method to restrict authentication to a specific Azure AD tenant. The Issuer URL, which corresponds to the 'iss' claim in a JWT, identifies the security token service that issued the token. By specifying a unique {tenant-id} (or a verified domain name) in this URL, the application is configured to only trust and accept tokens issued by that particular Azure AD instance, thereby enforcing single-tenant access control.
Go deeper
Related to this question
About these practice questions
One of 881 original AZ-204 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.