Describe the capabilities of Microsoft Entra →easyMultiple ChoiceObjective-mapped

SC-900 Describe the capabilities of Microsoft Entra Practice Question

Exhibit

Refer to the exhibit.

```
DisplayName        : Contoso HR App
ObjectId           : 12345678-1234-1234-1234-123456789012
Enabled            : True
SignInAudience     : AzureADMyOrg
IdentifierUris     : {https://api.contoso.com}
AppRoles           : {}
```

You are viewing an application registration in Microsoft Entra ID. What can you conclude about this app?

⚠ Common exam trap

Test-takers frequently confuse a disabled app (where the 'Enabled for users to sign-in?' toggle is set to 'No') with an app that has no app roles defined, leading them to incorrectly select option A when the app is actually enabled but lacks roles.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The app is a single-tenant application that is enabled but has no app roles defined

The application registration shows 'App roles' with a value of 0, which means no app roles are defined. The 'Supported account types' setting indicates 'Accounts in this organizational directory only', confirming it is a single-tenant application. The 'Enabled for users to sign-in?' toggle is set to 'Yes', so the app is enabled and can be used.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The app is disabled and cannot be used
Why it's wrong here
This statement is incorrect because the application's operational status is determined by its 'Enabled' property, which is explicitly set to 'True'. An application with 'Enabled: True' is active and fully functional within Microsoft Entra ID, allowing users to sign in and access its resources. If the application were disabled, this property would be set to 'False', preventing any authentication attempts or resource access.
✓
The app is a single-tenant application that is enabled but has no app roles defined
Why this is correct
This statement is correct as it accurately describes the application's configuration. The 'signInAudience' property being set to 'AzureADMyOrg' confirms it is a single-tenant application, restricted to users within the registering tenant. Furthermore, the 'AppRoles' collection is empty, indicating that no custom application-specific roles have been defined for granular access control within the application itself, while the 'Enabled' status is 'True'.
✗
The app has custom roles for role-based access
Why it's wrong here
This statement is incorrect because the 'AppRoles' property within the application registration manifest is empty. Custom roles for an application, which enable role-based access control (RBAC) within the application's logic, are defined as objects within this 'AppRoles' collection. An empty collection explicitly signifies that no such custom roles have been configured or published for this application.
✗
The app is multi-tenant and can be used by other tenants
Why it's wrong here
This statement is incorrect because the application's 'signInAudience' property is configured as 'AzureADMyOrg'. This setting explicitly designates the application as single-tenant, meaning it is intended for use only by users and guest users within the specific Microsoft Entra tenant where it was registered. For an application to be multi-tenant and usable by other organizations, its 'signInAudience' would need to be set to 'AzureADMultipleOrgs' or 'AzureADandPersonalMicrosoftAccount'.

Go deeper

SC-900 Describe the capabilities of Microsoft Entra Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question