The correct design is to register the application in Microsoft Entra ID using an App Registration and configure it to use OpenID Connect for authentication. This approach directly enables single sign-on (SSO) for both employees and external users, while also allowing the application to read user profile attributes via the Microsoft Graph API—a key requirement. Conditional access policies, including MFA enforcement for external users, are then applied to the resulting enterprise app in Entra ID, ensuring that authentication and authorization are centrally managed. On the AZ-305 exam, this scenario tests your understanding of how App Registrations provide the identity foundation for SaaS app identity, while conditional access policies are applied at the enterprise app level, not the registration itself. A common trap is confusing App Registrations (which define the app) with Enterprise Applications (which enforce policies). Remember the mnemonic: “Register for identity, Enterprise for policy.”
AZ-305 Practice Question: Design identity, governance, and monitoring solutions
This AZ-305 practice question tests your understanding of design identity, governance, and monitoring solutions. Read the scenario carefully and evaluate each option against the stated constraints before committing to an answer. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
Your company plans to deploy a new SaaS application that will be used by employees and external users. The application requires single sign-on (SSO) and must support conditional access policies that enforce MFA for external users. Additionally, the application must be able to read user profile attributes from Microsoft Entra ID. You need to design an identity solution that meets these requirements. What should you include in the design?
Register the application in Microsoft Entra ID (App Registration) and configure it to use OpenID Connect for authentication; apply conditional access policies to the app.
App registration supports SSO, conditional access, and Graph API for profile reads.
B
Use Azure AD Application Proxy to publish the SaaS app and configure pre-authentication with Entra ID.
Why wrong: Application Proxy is for on-premises apps, not SaaS.
C
Use Microsoft Entra Domain Services to authenticate the application via LDAP.
Why wrong: LDAP is not suitable for modern SSO and conditional access.
D
Register the application in Microsoft Entra B2C and configure federation with your Entra ID tenant.
Why wrong: B2C is not designed for employee SSO and conditional access.
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Register the application in Microsoft Entra ID (App Registration) and configure it to use OpenID Connect for authentication; apply conditional access policies to the app.
Option A is correct because registering the application in Microsoft Entra ID (App Registration) and configuring OpenID Connect (OIDC) enables SSO and allows the application to read user profile attributes via the Microsoft Graph API. Conditional access policies can be applied directly to the enterprise app in Entra ID to enforce MFA for external users, meeting all stated requirements.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✓
Register the application in Microsoft Entra ID (App Registration) and configure it to use OpenID Connect for authentication; apply conditional access policies to the app.
Why this is correct
App registration supports SSO, conditional access, and Graph API for profile reads.
Related concept
Read the scenario before looking for a memorised answer.
✗
Use Azure AD Application Proxy to publish the SaaS app and configure pre-authentication with Entra ID.
Why it's wrong here
Application Proxy is for on-premises apps, not SaaS.
✗
Use Microsoft Entra Domain Services to authenticate the application via LDAP.
Why it's wrong here
LDAP is not suitable for modern SSO and conditional access.
✗
Register the application in Microsoft Entra B2C and configure federation with your Entra ID tenant.
Why it's wrong here
B2C is not designed for employee SSO and conditional access.
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is that candidates may confuse Azure AD Application Proxy (for on-premises apps) or Entra B2C (for customer identities) with the correct solution for a SaaS app requiring employee and external user access with conditional access and Graph API reads.
Detailed technical explanation
How to think about this question
OpenID Connect (OIDC) is built on OAuth 2.0 and provides an ID token (JWT) that includes claims about the authenticated user, enabling SSO. The application can use the access token to call Microsoft Graph API's `/users/{id}` endpoint to read profile attributes. Conditional access policies evaluate signals like user location, device state, and risk level before issuing tokens, and can be scoped to specific cloud apps (the registered enterprise app) to enforce MFA for external users.
KKey Concepts to Remember
Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A company's IT admin needs to give a contractor read-only access to production logs without sharing account credentials. Using role-based access control (RBAC) and temporary scoped permissions — not a permanent shared password — is the correct pattern. Questions like this test whether you can apply least-privilege access across cloud identity services.
Related glossary terms
Concepts from this question explained
These glossary pages explain the core terms tested in this AZ-305 question in full detail.
Design identity, governance, and monitoring solutions — This question tests Design identity, governance, and monitoring solutions — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: Register the application in Microsoft Entra ID (App Registration) and configure it to use OpenID Connect for authentication; apply conditional access policies to the app. — Option A is correct because registering the application in Microsoft Entra ID (App Registration) and configuring OpenID Connect (OIDC) enables SSO and allows the application to read user profile attributes via the Microsoft Graph API. Conditional access policies can be applied directly to the enterprise app in Entra ID to enforce MFA for external users, meeting all stated requirements.
What should I do if I get this AZ-305 question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This AZ-305 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-305 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.