SC-300 Certification Practice Question #73

Question

You have a Microsoft Entra tenant that contains the users shown in the following table.

You add an enterprise application named App1 and configure the following Self-service settings:

•	Allow users to request access to this application: Yes
•	To which group should assigned users be added: Group1
•	Require approval before granting access to this application: Yes
•	Who is allowed to approve access to this application: User2

Which users can request access to App1?

Accepted Answer

Self-service application access, when "Allow users to request access" is set to **Yes**, is tenant-wide — there is no per-user/per-group "who may request" scope on this feature (unlike entitlement-management access packages). MS Learn describes the request flow as available to users via My Apps with no carve-out for users who already belong to the assignment group, and being an approver (User2) does not by itself grant or block requesting. Both the official Suggested Answer and the top community vote land on D (15 votes). The well-argued B camp (jitla7, 👍 11) reasons that User1 already has access through Group1 and therefore wouldn't *need* to request — a plausible real-world nuance, but the question asks who *can* request, not who needs to, and the eligibility to request is not gated by existing membership in the docs. Confidence is held at 78% because the community is genuinely split (Highly Voted B vs. Most Voted/Suggested D) and MS Learn does not explicitly address the already-assigned-user edge case.

More SC-300 practice questions