A company deploys an AI application on Azure App Service. The application uses a service principal to authenticate to Azure AI services. The security team wants to prevent this service principal's tokens from being used from outside the corporate network. Which Entra ID feature enforces this restriction?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — a is correct because Microsoft Entra Conditional Access for workload identities (available with Microsoft Entra Workload ID Premium) allows organizations to apply Conditional Access policies to service principals. You can create a policy that blocks the service principal from obtaining tokens when the request originates from outside named locations (e.g., corporate IP ranges), preventing token misuse from outside the network.
Full explanation below image
Full Explanation
A is correct because Microsoft Entra Conditional Access for workload identities (available with Microsoft Entra Workload ID Premium) allows organizations to apply Conditional Access policies to service principals. You can create a policy that blocks the service principal from obtaining tokens when the request originates from outside named locations (e.g., corporate IP ranges), preventing token misuse from outside the network. B is wrong because Entra ID Protection user risk policies apply to user identities, not service principals; workload identity risk requires the Workload ID Premium feature and specific configuration. C is wrong because Azure AD Application Proxy provides secure remote access to on-premises web apps; it does not restrict where service principal tokens can be used for Azure AI service calls. D is wrong because PIM manages when a service principal can have an active role assignment, not the network location from which its tokens are used.