A multi-tenant ticketing vendor’s app registration lives in the vendor tenant, but the grain elevator must assign Azure RBAC and review grants locally. Where should the security engineer work?
Select an answer to reveal the explanation.
Short Explanation
The vendor owns the blueprint in their tenant; you own the local badge. That badge is the service principal—enterprise app—in the grain elevator’s directory. Assign RBAC and review grants there, not by cloning the vendor’s app registration.
Full Explanation
For multi-tenant applications, the application object typically remains in the publisher’s home tenant, while each customer tenant receives a service principal (enterprise application) used for local sign-in, OAuth grants, and Azure RBAC. When a multi-tenant ticketing vendor’s app registration lives in the vendor tenant but the grain elevator must assign Azure RBAC and review grants locally, the security engineer should work against the service principal created in the grain-elevator tenant—not against the vendor’s home application object alone.
Creating a second identical app registration in the customer tenant as the default way to represent the vendor app fails the normal multi-tenant pattern, where admin/user consent instantiates or uses a local service principal. Storing the vendor’s client secret in a shared mailbox so operators can mint tokens without a service principal fails security, accountability, and identity design. Assigning Azure RBAC only to the vendor’s home-tenant application object GUID without a local service principal fails because role assignments in the customer’s subscriptions need a principal that exists in that tenant’s directory context.
Exam caveat: always locate the customer-tenant enterprise application when assigning Azure roles or reviewing grants for a multi-tenant SaaS. Operational check: identify the local service principal object ID, assign the least-privilege Azure role at the correct scope, review and document OAuth grants on that enterprise application, and train operators not to copy the vendor home-tenant app ID into IAM blades.