Explanation

Explanation

Reference:
https://docs.microsoft.com/en-us/azure-stack/operator/azure-stack-integrate-security?view=azs-2008

Explanation
Your choice of either Azure AD or AD FS is determined by the mode in which you deploy Azure Stack Hub:
When you deploy it in a connected mode, you can use either Azure AD or AD FS.
When you deploy it in a disconnected mode, without a connection to the internet, only AD FS is supported.
E:
Rotate certificate for AD FS identity application
The identity application is created by the operator before deployment of Azure App Service on Azure Stack Hub. If the application's object ID is unknown, follow these steps to discover it:
* Go to the Azure Stack Hub administrator portal.
* Go to Subscriptions and select Default Provider Subscription.
* Select Access Control (IAM) and select the AzureStack-AppService-<guid> application.
* Take a note of the Object ID, this value is the ID of the Service Principal that must be updated in AD FS.
D: To rotate the certificate for the application in AD FS, you need to have access to the privileged endpoint (PEP). Then you update the certificate credential using PowerShell.
# Sign in to PowerShell interactively, using credentials that have access to the VM running the Privileged Endpoint
$Creds = Get-Credential
# Create a new Certificate object from the identity application certificate exported as .cer file
$Cert = New-Object
System.Security.Cryptography.X509Certificates.X509Certificate2("<CertificateFileLocation>")
# Create a new PSSession to the PrivelegedEndpoint VM
$Session = New-PSSession -ComputerName "<PepVm>" -ConfigurationName PrivilegedEndpoint
-Credential $Creds -SessionOption (New-PSSessionOption -Culture en-US -UICulture en-US)
# Use the privileged endpoint to update the certificate thumbprint, used by the service principal associated with the App Service identity application
$SpObject = Invoke-Command -Session $Session -ScriptBlock {Set-GraphApplication -ApplicationIdentifier
"<ApplicationObjectId>" -ClientCertificates $using:Cert}
$Session | Remove-PSSession
# Output the updated service principal details
$SpObject
Reference:
https://learn.microsoft.com/en-us/azure-stack/operator/azure-stack-identity-overview
https://learn.microsoft.com/en-us/azure-stack/operator/app-service-rotate-certificates

Explanation
Box 1: 3
3 registered, and one in need of an update.
Note: Update the Azure Stack Hub directories
When an Azure Stack Hub directory update is required, a status of Update Required is shown. For example:
Graphical user interface, application Description automatically generated

To update the directory, select the Directory name checkbox, and then select Update.
Box 2: global administrator of ITHCSubAS2021.onmicrosoft.com
The guest directory ITHCSubAS2021.onmicrosoft.com needs an update.
Update the guest directory
An Azure Stack Hub operator should also inform the guest directory owner that they need to update their directory by using the URL shared for registration.
Reference:
https://learn.microsoft.com/en-us/azure-stack/operator/enable-multitenancy

Explanation

A picture containing text Description automatically generated
Reference:
https://docs.microsoft.com/en-us/azure-stack/operator/azure-stack-add-manage-billing-as-a-csp?view=azs-2008
https://docs.microsoft.com/en-us/azure-stack/operator/azure-stack-csp-howto-register-tenants?view=azs-2008&ta