SC-300 Certification Practice Question #173

Question

You have a Microsoft 365 subscription.

You need to ensure that users can grant enterprise applications access to their profile. The solution must ensure that the users can consent only to the User.Read and profile delegated permissions.

What should you configure first?

Accepted Answer

The requirement is to let users consent to enterprise apps but only for the `User.Read` and `profile` delegated permissions. The built-in consent policy that allows this is "Allow user consent for apps from verified publishers, for selected permissions" (`microsoft-user-default-low`), which only lets users consent to permissions you have classified as *low impact*. MS Learn is explicit that you must classify the permissions *first* to define which ones users may consent to; the consent setting then references that classification. Because the question asks what to configure **first**, the permission classification must exist before the user-consent setting becomes meaningful. Suggested Answer, Most Voted, both comments, and MS Learn all converge on B.

More SC-300 practice questions