A municipal permitting office asks how a SaaS vendor integration typically appears for identity and access management in Microsoft Entra ID. Which answer fits?

A municipal permitting office asking how a SaaS vendor integration typically appears for identity and access management in Microsoft Entra ID should answer: as an Enterprise application that administrators manage for SSO and access. That enterprise app object is where admins assign users, review permissions, apply Conditional Access, and manage SSO properties for the vendor integration. Letting the office staff configure an app registration for SSO and consent leaves out the assignment, SSO configuration, and access-review surface administrators actually manage day to day for the vendor integration. Using a Microsoft Entra security group to assign users for application access conflates membership management with the identity and SSO configuration that a dedicated application object provides. Treating a Conditional Access policy that enforces SSO and controls vendor access as the integration has nothing to target; Conditional Access applies conditions to an existing cloud app object, it does not substitute for one.

Exam caveat: SaaS integrations in Entra are Enterprise applications (often paired with an application registration). Meeting policies, deleted users, and anonymous links are distractors that test whether you know the enterprise-app concept.

Operational check: In Entra Enterprise applications, locate the permitting SaaS app, verify SSO mode and reply URLs, confirm user assignment versus “user assignment required,” review granted permissions, and validate a permitting staff sign-in end to end.