AZ-500 Question 23
Select 2You have registered a new enterprise application in Microsoft Entra ID (Azure AD). You want to ensure that only specific administrators can grant users access to this application. Additionally, you need to prevent any unassigned users from signing in. Which of the following steps should you perform in the Azure portal to meet these requirements? (Choose two.)
- A
Enable 'User assignment required?' in the enterprise application’s Properties blade.
- B
Disable 'User assignment required?' for the application.
- C
Assign the application exclusively to a security group containing designated administrators.
- D
Enable tenant-wide user consent in the User settings for Microsoft Entra ID.
- E
Grant Admin Consent from the Permissions blade of the enterprise application.
Show answer and explanation
Correct answers: A, C
Explanation
In Microsoft Entra ID (Azure AD), setting 'User assignment required?' to 'Yes' ensures that only explicitly assigned users can sign into the application. By granting assignment solely to a specific group of administrators, you maintain tighter control and fulfill the scenario requirement of preventing user self-assignment. For details on this configuration, refer to the official documentation on 'Assign users and groups to an enterprise application' in Microsoft Entra ID.
- A. Correct.
Correct. Enabling 'User assignment required?' ensures users must be explicitly assigned to the application before they can access it, preventing unassigned users from signing in.
- B. Incorrect.
Incorrect. Disabling 'User assignment required?' would allow all users to access the application (unless other restrictions are in place), which conflicts with the requirements.
- C. Correct.
Correct. By assigning the application only to a specific group of administrators (or groups controlled by administrators), you ensure that only they can grant access to additional users.
- D. Incorrect.
Incorrect. Enabling tenant-wide user consent would allow all users in the tenant to consent to the application, bypassing your requirement for controlled access.
- E. Incorrect.
Incorrect. Granting Admin Consent from the Permissions blade handles delegated or application permissions for the app’s API permissions but does not control which users can sign in to the application.