Azure AD tenants and directories - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

Understanding Azure AD Tenant Isolation

Which statement best describes the isolation between two Azure AD tenants?

A Users and resources in one tenant cannot access resources in another tenant without explicit guest invitations.

B Users in one tenant can access resources in another tenant by default if they share the same domain name.

C All tenants under the same Azure subscription share the same user directory automatically.

D Tenants are isolated only at the subscription level but share user identities across tenants.

💡 Hint

Think about how Azure AD controls access across different organizations.

Azure AD tenants are separate directories. Users in one tenant cannot access another tenant's resources unless invited as guests.

❓ Architecture

intermediate

Choosing the Right Azure AD Tenant for a Multi-Region Company

A company operates in multiple countries and wants to centralize user management while complying with data residency laws. Which Azure AD tenant strategy is best?

A Create a single Azure AD tenant for all regions and use conditional access policies to restrict data access by location.

B Create separate Azure AD tenants for each country and do not link them to maintain data residency compliance.

C Use one tenant per region but synchronize users across tenants using Azure AD Connect.

D Use multiple tenants but merge them into one tenant monthly to centralize user data.

💡 Hint

Consider how Azure AD supports centralized management and compliance controls.

A single tenant with conditional access allows centralized management and enforces location-based policies to meet residency laws.

❓ security

advanced

Impact of Guest User Invitations on Azure AD Tenant Security

What is the primary security risk when inviting guest users from external organizations into your Azure AD tenant?

A Guest users gain full administrative rights by default in the host tenant.

B Guest users can delete the host tenant's directory if invited incorrectly.

C Guest users automatically synchronize their credentials with the host tenant's directory.

D Guest users can access resources beyond what is explicitly shared if permissions are not carefully managed.

💡 Hint

Think about permission boundaries and sharing controls.

Guest users only have access to resources shared with them, but improper permission management can lead to overexposure.

❓ service_behavior

advanced

Azure AD Tenant Behavior on Subscription Transfer

What happens to the Azure AD tenant association when an Azure subscription is transferred from one tenant to another?

A The subscription remains linked to the original tenant, and transfer is not possible.

B The subscription moves to the new tenant, and all users from the old tenant lose access immediately.

C The subscription is associated with the new tenant, but users from the old tenant retain access until explicitly removed.

D The subscription is deleted and must be recreated under the new tenant.

💡 Hint

Consider how Azure manages user access during subscription transfers.

When a subscription is transferred, it associates with the new tenant, but user access from the old tenant continues until changed.

✅ Best Practice

expert

Best Practice for Managing Multiple Azure AD Tenants in a Large Organization

In a large organization with multiple Azure AD tenants, what is the best practice to ensure secure and efficient user access management?

A Manually create duplicate user accounts in each tenant to maintain separation and avoid cross-tenant access.

B Use Azure AD B2B collaboration to invite users across tenants and manage access centrally with role-based access control (RBAC).

C Merge all tenants into one tenant regardless of organizational boundaries to simplify management.

D Disable guest access and require users to switch tenants manually to access resources.

💡 Hint

Think about how Azure AD supports collaboration and access control across tenants.

Azure AD B2B collaboration with RBAC allows secure, centralized management of users across multiple tenants without duplication.

Practice

1. What is an Azure AD tenant primarily used for?

easy

A. To store virtual machines in the cloud

B. To manage users and control access within an organization

C. To host websites publicly

D. To create databases for applications

Solution

1. Step 1: Understand Azure AD tenant purpose and identify correct use case

   An Azure AD tenant is a dedicated space for managing identities and access. It is not for hosting websites, storing VMs, or databases but for user and access management.

2. Final Answer:

   To manage users and control access within an organization -> Option B

3. Quick Check:

   Azure AD tenant = user and access management [OK]

Hint: Azure AD tenant = user and access management space [OK]

Common Mistakes:

• Confusing tenant with storage or hosting services
• Thinking tenant is a database service
• Assuming tenant manages virtual machines

2. Which of the following is the correct Azure CLI command to list all Azure AD tenants you have access to?

easy

A. az ad tenant list

B. az login tenant list

C. az tenant show

D. az account tenant list

Solution

1. Step 1: Recall Azure CLI commands for tenants and identify correct one

   The command to list tenants is under 'az account' namespace, not 'az ad'. 'az account tenant list' lists all tenants you have access to.

2. Final Answer:

   az account tenant list -> Option D

3. Quick Check:

   List tenants = az account tenant list [OK]

Hint: Use 'az account tenant list' to see all tenants [OK]

Common Mistakes:

• Using 'az ad tenant list' which is invalid
• Confusing 'az login' with tenant listing
• Using 'az tenant show' which does not exist

3. Given the following Azure CLI output snippet after running az account tenant list:

[{"tenantId": "1111-2222-3333-4444", "isDefault": true}, {"tenantId": "5555-6666-7777-8888", "isDefault": false}]

What does the isDefault field indicate?

medium

A. The tenant that is deleted

B. The tenant with the most users

C. The tenant currently active for your Azure session

D. The tenant with the highest subscription cost

Solution

1. Step 1: Understand 'isDefault' meaning and eliminate incorrect options

   'isDefault' marks which tenant is currently active in your Azure CLI session. It does not relate to user count, cost, or deletion status.

2. Final Answer:

   The tenant currently active for your Azure session -> Option C

3. Quick Check:

   isDefault = active tenant [OK]

Hint: 'isDefault' means active tenant in session [OK]

Common Mistakes:

• Thinking 'isDefault' means largest tenant
• Assuming it means deleted tenant
• Confusing it with billing or cost info

4. You run the command az ad tenant list but get an error saying the command is not found. What is the most likely cause?

medium

A. The Azure CLI does not have a direct 'az ad tenant list' command

B. You are not logged in to Azure CLI

C. Your account has no tenants

D. The Azure CLI version is too new

Solution

1. Step 1: Check command availability and verify other causes

   'az ad tenant list' is not a valid Azure CLI command; tenant listing is under 'az account'. Login issues or no tenants would give different errors; CLI version too new is unlikely to remove commands.

2. Final Answer:

   The Azure CLI does not have a direct 'az ad tenant list' command -> Option A

3. Quick Check:

   Invalid command = no 'az ad tenant list' [OK]

Hint: Tenant list is under 'az account', not 'az ad' [OK]

Common Mistakes:

• Assuming login error causes command not found
• Thinking no tenants causes command error
• Blaming CLI version without checking command docs

5. You want to create a new Azure AD tenant for a subsidiary company and assign a custom domain name. Which steps should you follow to do this correctly?

hard

A. Create a new tenant in Azure portal, then add and verify the custom domain in that tenant

B. Add the custom domain to your current tenant, then create a new subscription for the subsidiary

C. Create a new subscription, which automatically creates a tenant with the custom domain

D. Use Azure CLI to rename your existing tenant to the subsidiary's domain

Solution

1. Step 1: Create new Azure AD tenant and add custom domain

   Use the Azure portal to create a separate tenant for the subsidiary company. Within the new tenant, add the subsidiary's custom domain and verify ownership.

2. Final Answer:

   Create a new tenant in Azure portal, then add and verify the custom domain in that tenant -> Option A

3. Quick Check:

   New tenant + verify domain = correct process [OK]

Hint: New tenant first, then add custom domain inside it [OK]

Common Mistakes:

• Adding domain to wrong tenant
• Assuming subscription creation creates tenant with domain
• Trying to rename existing tenant domain