Which Two Credentials Let App1 Access App2 Across Tenants?
Short answer
AC App1 authenticates to App2 in the partner tenant via the client credentials flow using either a client certificate or a client secret.
Question
Key Takeaways
The question tests the credential types of a confidential client doing app-to-app authentication across two Entra tenants, and the trap is reaching for human or resource-bound identity types such as a user account or managed identity that never appear in the client credentials grant.
App1 is an app registration in your Microsoft Entra tenant that must reach App2 in a partner organization's tenant, which requires app-only, cross-tenant authentication through the OAuth 2.0 client credentials flow. This page establishes that the two valid credential types App1 can present are a certificate and a client secret.
Common mistake: The most common wrong pick is a user account (option D) — learners imagine inviting a guest user or signing in as a user in the partner tenant, but an app registration acquired through the client credentials flow cannot authenticate as a human user with a delegated token.
Expert Analysis
Why the Answer Is Correct
App1 is a daemon-style app registration in your tenant and App2 is a registered app in the partner tenant, so access happens with no signed-in user: App1 first gets a service principal in the partner tenant (multi-tenant app plus admin consent) and then proves its own identity to the Microsoft identity platform token endpoint. The OAuth 2.0 client credentials grant accepts exactly two credential types for a confidential client, and the options list both of them: a certificate (a public/private key pair, option A) and a client secret (option C). Because the question states that each correct answer presents a complete solution, either credential alone is sufficient — App1 does not need a certificate and a secret, it needs one of the two. This matches the source key (AC) and the dominant community pick.
Why the Other Options Are Wrong
A managed identity (B) is bound to an Azure resource inside a single tenant; it has no service principal that the partner tenant can consent to, so it cannot be used to get a token for App2 — it is the right tool for same-tenant Azure resources, not for cross-tenant app access. A user account (D) is a human credential that requires interactive sign-in and yields delegated permissions, which is the wrong flow entirely for an application acting on its own behalf. A one-time password (E) is not a client credential at all; OTP codes are a user authentication factor (MFA), and no app registration can be configured with one as its authentication secret.
Community Comment Notes
Shingie answers AC and frames it exactly as the exam expects, describing app-to-app authentication with the OAuth 2.0 client credentials flow and calling out "A. Certificate & C. Secret". The vote split shows the runner-up answer was AD, and armid floated the reasoning behind it — "teachically you could use guest user account, no?" — before abandoning it and posting "correcting to ac". That reversal is a useful reminder that a guest user in the partner tenant can be granted permission to a resource, but it can never serve as the credential type of App1, which is what this question asks for.
Official Reference
- https://learn.microsoft.com/en-us/entra/identity-platform/v2-oauth2-client-creds-grant-flow
- https://learn.microsoft.com/en-us/entra/identity-platform/certificate-credentials
These links open the official vendor documentation in a new tab.
Exam Strategy
When a scenario pairs two tenants and two registered apps, immediately map it to the client credentials grant and recall that a confidential client gets only two credential types: a client secret and a certificate. Anything describing a human factor (user account, one-time password) or a resource-bound identity (managed identity) is a distractor in this flow.
Frequently Asked Questions
Why can't App1 use a managed identity to access App2 in the partner tenant?
Could a guest user account in the partner tenant let App1 reach App2?
Community Votes
67% of anonymous learners picked answer AC. Votes are pick records left by other test-takers — they are not the verified answer.
Discussion 3 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 3
-
Shingie 👍 3Answer: A. Certificate & C. Secret Explanation: To allow App1 in your Azure tenant to authenticate and access App2 in the partner organization's Azure tenant, you typically use app-to-app authentication with OAuth 2.0 client credentials flow. The two valid credential types for this authentication are: ✅ A. Certificate – Apps can use a public-private key pair (certificate) for authentication, which is considered more secure than secrets. ✅ C. Secret – Apps can use a client secret (a password-like string) to authenticate, though it's less secure than certificates. Why not the others? ❌ B. Managed Identity – Managed identities are used only within a single tenant and cannot be used across different Microsoft Entra tenants. ❌ D. User Account – The client credentials flow does not involve interactive user authentication. Instead, App1 authenticates as itself. ❌ E. One-time password – OTPs are for human users, not for app-to-app authentication.
-
armid 👍 2teachically you could use guest user account, no? Not sure if "secret" alone represents a "complete" solution
-
armid 👍 1correcting to ac
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.
Related Analysis
Practice All SC-300 Questions
Access 80 questions with complete answers and detailed explanations.
View Full SC-300 Practice Test →