SC-300 Certification Practice Question #242

Question

You have a hybrid Microsoft 365 subscription that contains the users shown in the following table.

You plan to deploy an on-premises app named App1. App1 will be registered in Azure AD and will use Azure AD Application Proxy.

You need to delegate the installation of the Application Proxy connector and ensure that User1 can register App1 in Azure AD. The solution must use the principle of least privilege.

Which user should perform the installation, and which role should you assign to User1? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

Accepted Answer

Two least-privilege decisions. Installing/registering the Application Proxy connector requires the Application Administrator role — MS Learn's least-privileged-roles-by-task table and the connector install guides both name Application Administrator, and the Cloud Application Administrator role explicitly excludes app-proxy management. Global Administrator (Admin1) would work but violates least privilege, so the connector installer is Admin2 (Application Administrator). For User1 to register App1, the requirement is only the ability to create an application registration. MS Learn states the Application Developer role grants creating app registrations even when "Users can register applications" is set to No, and it is the least-privileged role for that task — below Cloud Application Administrator and Application Administrator. The dissent arguing Application Administrator conflates registering the app with also managing app-proxy on it, but the question asks only that User1 can "register App1," so Application Developer is correct and least-privileged. Confidence is in the mid band: Box 1 is near-unanimous, while Box 2 carries a real (but weaker) minority for Application/Cloud Application Administrator that MS Learn rules against on least-privilege grounds.

More SC-300 practice questions