Your company has a Microsoft 365 tenant.

According to the Microsoft Identity and Access Administrator (SC-300) Study Guide and Microsoft Learn modules on “Implement access management for apps” and “Implement Conditional Access policies” , Azure AD provides centralized identity and access management for integrated SaaS applications (such as Service1) that support Azure AD authentication and OAuth .

Ensure that users connect to Service1 without being prompted for authentication: When a third-party application is published in the Azure AD gallery , it supports federated single sign-on (SSO) using SAML, OAuth, or OpenID Connect. Registering the application as an enterprise application (rather than creating a new app registration) enables Azure AD to manage SSO automatically. The Microsoft documentation states:

“Enterprise applications from the Azure AD gallery can be configured for single sign-on so that users can access the app using their Azure AD credentials without being prompted to reauthenticate.”

Therefore, to achieve seamless sign-on with minimal administrative overhead, the correct option is An enterprise application in Azure AD .

Ensure that users can access Service1 only from Azure AD-joined computers: To restrict access based on device compliance or join status, Azure AD uses Conditional Access policies . Conditional Access allows enforcement of conditions such as “Require device to be marked as compliant” or “Require hybrid Azure AD-joined or Azure AD-joined device.” The official Microsoft guidance under “Plan and implement Conditional Access policies” confirms:

“You can enforce that users only access cloud resources from devices that are Azure AD-joined or compliant by applying Conditional Access device filters.”

Thus, to ensure that only Azure AD-joined devices can access Service1, you implement a Conditional Access policy .