Quick Answer
The correct answer is to create an enterprise application with SAML-based sign-on. This is because Microsoft Entra ID uses enterprise applications as the container for integrating third-party SaaS apps, and SAML 2.0 requires configuring SAML-based sign-on within that container so Entra ID can act as the identity provider, exchanging SAML assertions for authentication. On the MS-102 exam, this concept tests your understanding of how to bridge external apps with Entra ID’s identity services, often appearing in scenario-based questions where you must choose between app registrations and enterprise applications—a common trap is selecting “app registration,” which is for custom-developed apps, not pre-built SaaS integrations. Remember the key distinction: enterprise apps are for gallery or non-gallery third-party integrations, while app registrations are for your own code. A useful memory tip is “SAML needs an Enterprise” to recall that SAML-based SSO always requires an enterprise application in Entra ID.
This MS-102 practice question tests your understanding of implement and manage microsoft entra identity and access. This is a configuration task: choose the command set that satisfies every stated requirement. Small differences — like 'secret' vs 'password' or 'transport input ssh' vs 'all' — change whether the answer is correct. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
Your organization plans to use Microsoft Entra ID as the identity provider for a third-party SaaS application that supports SAML 2.0. You need to configure single sign-on (SSO) for the application. What should you create in Microsoft Entra ID?
An enterprise application with SAML-based sign-on
Enterprise applications support SAML 2.0 federation.
An Application Proxy connector group
Why wrong: Application Proxy is for on-premises apps, not SAML SSO.
A service principal for Microsoft Graph
Why wrong: Microsoft Graph service principal is for API access, not SAML SSO.
An app registration with OpenID Connect
Why wrong: OpenID Connect is not SAML.
Answer choices
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
An enterprise application with SAML-based sign-on
To configure SSO for a third-party SaaS application that supports SAML 2.0, you must create an enterprise application in Microsoft Entra ID and configure it with SAML-based sign-on. Enterprise applications are designed for integrating third-party applications, and SAML-based sign-on allows Entra ID to act as the identity provider, exchanging SAML assertions for authentication.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
For each option: why learners choose it and why it is or isn't the right answer here.
An enterprise application with SAML-based sign-on
Why this is correct
Enterprise applications support SAML 2.0 federation.
Related concept
Read the scenario before looking for a memorised answer.
An Application Proxy connector group
Why it's wrong here
Application Proxy is for on-premises apps, not SAML SSO.
A service principal for Microsoft Graph
Why it's wrong here
Microsoft Graph service principal is for API access, not SAML SSO.
An app registration with OpenID Connect
Why it's wrong here
OpenID Connect is not SAML.
Common exam traps
The trap here is that candidates often confuse app registrations (used for OIDC/OAuth apps) with enterprise applications (used for SAML-based SSO), leading them to choose Option D, even though SAML 2.0 requires the enterprise application gallery or custom enterprise app configuration.
Detailed technical explanation
Under the hood, when you create an enterprise application with SAML-based sign-on, Entra ID generates a SAML metadata endpoint and a certificate for signing assertions. The third-party SaaS app consumes this metadata to establish a trust relationship, and during authentication, Entra ID issues a SAML response containing the user's attributes (e.g., NameID) to the app's ACS (Assertion Consumer Service) URL. A subtle behavior is that if the app requires a specific NameID format (e.g., email address or UPN), you must configure claims mapping in the SAML settings to avoid authentication failures.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
A company's IT admin needs to give a contractor read-only access to production logs without sharing account credentials. Using role-based access control (RBAC) and temporary scoped permissions — not a permanent shared password — is the correct pattern. Questions like this test whether you can apply least-privilege access across cloud identity services.
What to study next
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Implement and manage Microsoft Entra identity and access — study guide chapter
Learn the concepts, then practise the questions
Implement and manage Microsoft Entra identity and access practice questions
Targeted practice on this topic area only
All MS-102 questions
975 questions across all exam domains
Microsoft 365 Administrator MS-102 study guide
Full concept coverage aligned to exam objectives
MS-102 practice test guide
How to use practice tests most effectively before exam day
Related practice questions
Use these pages to review the topic behind this question. This is how one missed question becomes focused revision.
Practise MS-102 questions linked to Deploy and manage a Microsoft 365 tenant.
Practise MS-102 questions linked to Implement and manage Microsoft Entra identity and access.
Practise MS-102 questions linked to Manage security and threats by using Microsoft Defender XDR.
Practise MS-102 questions linked to Manage compliance by using Microsoft Purview.
Practise MS-102 questions linked to Manage users, groups, licensing, and support.
Practise MS-102 questions linked to Implement and manage identity and access in Microsoft Entra ID.
Practise MS-102 questions linked to MS-102 fundamentals.
Practise MS-102 questions linked to MS-102 scenario.
Practise MS-102 questions linked to MS-102 troubleshooting.
Practice this exam
Short sessions build daily habit. Longer sessions build exam-day stamina. Try a timed session to simulate real conditions.
FAQ
Implement and manage Microsoft Entra identity and access — This question tests Implement and manage Microsoft Entra identity and access — Read the scenario before looking for a memorised answer..
The correct answer is: An enterprise application with SAML-based sign-on — To configure SSO for a third-party SaaS application that supports SAML 2.0, you must create an enterprise application in Microsoft Entra ID and configure it with SAML-based sign-on. Enterprise applications are designed for integrating third-party applications, and SAML-based sign-on allows Entra ID to act as the identity provider, exchanging SAML assertions for authentication.
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Last reviewed: Jun 24, 2026
This MS-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MS-102 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.