An AKS cluster (AKS1) must have access granted to users in the contoso.com Azure AD tenant, but currently you cannot grant those users access. What should you do first to enable granting access to contoso.com users?

To allow users from an external Azure AD tenant (contoso.com) to access an AKS cluster, you must first establish a trust relationship. Creating an OAuth 2.0 authorization endpoint within the contoso.com tenant enables this by providing the necessary authentication mechanism for AKS to validate user identities from that tenant. Without this endpoint, AKS cannot authenticate users from contoso.com. Changing Organization relationships settings is for B2B collaboration, not direct AKS access. Recreating AKS1 is unnecessary and doesn't solve the authentication issue. Creating a namespace on AKS1 is an internal cluster operation and doesn't address external user authentication.