AZ-204 Implement Azure security Practice Question
You have a multi-tenant application that uses Azure AD (Microsoft Entra ID) for authentication. You want to allow only specific tenants to access your app. What is the recommended approach?
⚠ Common exam trap
Candidates often confuse the 'iss' claim (issuer) with the 'tid' claim (tenant ID), assuming issuer validation is sufficient, but the 'iss' claim can be less predictable in multi-tenant scenarios, especially when using the 'common' or 'organizations' endpoints, whereas 'tid' is the precise and recommended claim for tenant filtering.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
In the application code, validate the 'tid' claim against a list of allowed tenant IDs.
The 'tid' claim in the Azure AD-issued token uniquely identifies the tenant. By validating this claim against a hardcoded list of allowed tenant IDs in your application code, you can enforce multi-tenant access control without relying on Azure AD tenant-level restrictions or issuer URL validation, which can be less precise.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
In the application code, validate the 'tid' claim against a list of allowed tenant IDs.
Why this is correct
For multi-tenant applications, the 'tid' (tenant ID) claim in the incoming JWT token explicitly identifies the Azure AD tenant that issued the token. By implementing a server-side validation check, the application can compare this 'tid' against a pre-defined whitelist of authorized tenant IDs. This programmatic approach ensures that only users from approved organizational tenants can access the application, effectively enforcing tenant-level isolation and security policies directly within the application's trust boundary.
- ✗
Configure the app manifest to require user assignment and assign users from allowed tenants.
Why it's wrong here
Configuring an application to require user assignment is primarily designed for single-tenant or enterprise applications to control individual user access *within* a specific tenant. While it allows administrators to explicitly assign users or groups, it does not provide a mechanism to restrict access at the *tenant level* for a multi-tenant application. A multi-tenant application, by definition, is registered once and can be consented to by multiple organizations, making user assignment an impractical and ineffective method for tenant-wide restriction.
- ✗
Validate the 'iss' claim to ensure it matches one of your allowed tenant issuer URLs.
Why it's wrong here
The 'iss' (issuer) claim in an Azure AD token contains the full URL of the token issuer, which includes the tenant ID (e.g., 'https://sts.windows.net/<tenant-id>/'). While it is technically possible to parse the tenant ID from this URL or validate the entire issuer URL against a whitelist, this approach is less robust than using the dedicated 'tid' claim. The format of the issuer URL could potentially change or vary, whereas the 'tid' claim provides a direct, stable, and explicit identifier for the tenant, making it the more reliable and recommended method for tenant-based access control.
- ✗
Use Azure AD tenant restrictions to block all tenants except the allowed ones.
Why it's wrong here
Azure AD tenant restrictions are a security feature implemented by *tenant administrators* to control which external tenants their users can access. This mechanism is enforced at the network proxy or client device level within the *resource tenant's* environment, not by the application itself. An application developer cannot configure or rely on tenant restrictions to enforce access policies for their multi-tenant application, as these restrictions are external to the application's control and managed by the consumer tenants.
Go deeper
Related to this question
About these practice questions
One of 881 original AZ-204 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.