SC-300 Certification Practice Question #135

Question

You have an Azure AD tenant.

You deploy a new enterprise application named App1.

When users attempt to provide App1 with access to the tenant, the attempt fails.

You need to ensure that the users can request admin consent for App1. The solution must follow the principle of least privilege.

What should you do first?

Accepted Answer

The requirement is to let users *request* admin consent (not to grant it for them), following least privilege. Microsoft Learn's admin-consent-workflow article shows the first action is enabling the workflow — setting "Users can request admin consent to apps they are unable to consent to" to Yes — which surfaces the "Approval required" request experience. Designating a reviewer (B) is configured within that same workflow but only after/while enabling it, so "first" points to A. Granting App1 admin consent outright (C) gives access rather than enabling a request and exceeds least privilege, and a Conditional Access policy (D) governs sign-in conditions, not consent requests. Suggested Answer, the 7-vote majority / 7-👍 Highly Voted comment, and MS Learn all agree on A.

More SC-300 practice questions