How does AKS api-server authN/Z with resources provisioned in customer's tenant (non-Microsoft tenant)?
I can see one enterprise application with same name as that of aks cluster, is added with contributor role on managed resource group, does that play any role?
The api server does not authenticate with the nodes, its the other way around. Certificates are used for authentication, and there are different ways the traffic flow can be configured. See this page https://learn.microsoft.com/en-us/troubleshoot/azure/azure-kubernetes/tunnel-connectivity-issues
The enterprise app you're seeing allows AKS to create infrastructure resources such as VM nodes and load balancers as required through scaling requests or new workloads being created.