An App Service web app (App1) in subscription Sub1 is configured to use Azure AD as a single-tenant application; users in contoso.com can sign in. What should you recommend to allow users from the fabrikam.com tenant to authenticate to App1?

To allow users from fabrikam.com to authenticate to App1, you need to modify the application registration. Changing the "Supported account types" to "Accounts in any organizational directory (Any Azure AD directory - Multitenant)" enables users from other Azure AD tenants to sign in. Additionally, updating the sign-in endpoint in your application to the common endpoint (e.g., https://login.microsoftonline.com/common/oauth2/v2.0/authorize) ensures that the authentication request is routed correctly across tenants. Azure AD join is for device management, not multi-tenant application access. Azure AD Identity Protection focuses on detecting and remediating identity-based risks. Conditional Access policies control access based on conditions but don't inherently enable multi-tenant authentication for an application configured as single-tenant.