A botanical-garden SaaS has no enterprise-application owners, so every SSO certificate renewal waits on a Global Administrator. What assignment fixes day-to-day ownership of that app’s tenant settings?
Select an answer to reveal the explanation.
Short Explanation
No owners means every certificate renewal becomes a Global Admin ticket. Put at least two people on the enterprise-app Owners blade so the garden can renew SSO settings without waking the whole tenant admin team.
Full Explanation
Enterprise application owners can manage tenant-specific settings for that service principal—SSO certificates, user assignment, properties—without making everyone a Global Administrator. Assigning at least two users as owners on the botanical-garden SaaS enterprise application fixes day-to-day ownership so certificate renewals and app settings do not wait on Global Administrator.
Assigning Azure RBAC Owner on a related VM subscription fails by concept: Azure resource Owner does not inherit enterprise-application admin rights in Entra. Creating a custom Entra role that duplicates Global Administrator fails least privilege and is the wrong fix for app-level ownership. Moving the application object into a new app registration owned by the garden and deleting the enterprise application fails operationally for a SaaS gallery app model and risks breaking SSO rather than assigning owners correctly.
Exam caveat: use two owners for continuity; owners still should not replace privileged-role governance for tenant-wide admin tasks. Operational check: assign two owners, have an owner renew or view the SSO certificate settings, confirm a non-owner without privileged roles cannot, and remove unnecessary Global Administrator involvement from the runbook.