A gannet-cliff camera site has sign-in code ready but no directory application object yet. What Microsoft identity platform step must the developer complete before MSAL can sign users in?
Select an answer to reveal the explanation.
Short Explanation
MSAL needs an app registration the way a badge printer needs an employee record—client ID, redirect URI, and a credential. Bastion and Defender are ops/security products; a resource group alone is not an identity.
Full Explanation
Before MSAL can sign users in, the Microsoft identity platform needs an application registration in the tenant: an application (client) ID, redirect URIs that match the app’s callback URLs, and a credential appropriate to the app type (secret or certificate for confidential clients; public clients rely on the redirect/PKCE pattern without a secret). The gannet-cliff camera site’s sign-in code is insufficient alone; without an app registration there is no client identity for authorize/token endpoints to recognize. Creating that app registration is the mandatory directory step that unlocks MSAL configuration.
Deploying Azure Bastion fails the concept: Bastion provides secure RDP/SSH to VMs, not Entra ID application identity for MSAL user sign-in.
Enabling Microsoft Defender for Cloud plans fails because security posture plans are unrelated to whether a redirect URI is registered on an application object.
Creating only a resource group named after the client ID fails because a resource group is an Azure Resource Manager organizational boundary, not an identity-platform app registration, and skipping registration leaves MSAL without a client ID/redirect configuration.
Exam caveat: redirect URIs must match exactly (scheme, host, path, and trailing slash sensitivity); mismatch is one of the most common sign-in failures after registration. Operational check: register the app, copy the client ID into MSAL configuration, add the precise redirect URI, and complete an interactive sign-in acquiring a token against a known scope such as Microsoft Graph’s user read or your API’s exposed scope.