Question 320
Employees see a cluttered My Apps portal and want related finance applications grouped for easier discovery without changing who is authorized. The proposed change is: Create appropriate enterprise application collections and include the relevant finance apps for targeted users. After applying the intended configuration, which observation most directly proves that the required behavior works?
- Attempt access with a blocked test identity and verify Conditional Access is evaluated before the app responds.
- Open My Apps as a pilot employee and verify the collection appears while existing app access remains unchanged.
- Verify an unassigned test employee is denied while an assigned employee can sign in.
- Submit an app consent request and verify it enters the reviewer queue without granting permissions prematurely.
Explanation
Correct Answer
B:Open My Apps as a pilot employee and verify the collection appears while existing app access remains unchanged. This directly tests the effective outcome, not merely that a configuration exists. It establishes whether the intended change works: create appropriate enterprise application collections and include the relevant finance apps for targeted users. Failure would be evident in this case: an app collection is visible but a user still receives AccessDenied when launching an unassigned finance app.
Incorrect Answers
A:The proposed observation checks the different application proxy preauthentication scenario. Even a successful test would not establish the requested outcome here: open My Apps as a pilot employee and verify the collection appears while existing app access remains unchanged.
C:The proposed observation checks the different enterprise app user assignment requirement scenario. Even a successful test would not establish the requested outcome here: open My Apps as a pilot employee and verify the collection appears while existing app access remains unchanged.
D:The proposed observation checks the different admin consent request workflow scenario. Even a successful test would not establish the requested outcome here: open My Apps as a pilot employee and verify the collection appears while existing app access remains unchanged.
Question 321
An app collection is visible but a user still receives AccessDenied when launching an unassigned finance app. Which root cause best explains the described result rather than merely treating its symptoms?
- SAML sign-in configuration alone does not enable SCIM provisioning or scope the user into it.
- The provisioning credential or endpoint authorization has expired or become invalid.
- Application collection organization does not create enterprise application authorization or assignments.
- Delegated user consent did not authorize the requested application-only roles in the customer tenant.
Explanation
Correct Answer
C:Application collection organization does not create enterprise application authorization or assignments. This is the causal explanation of the observed behavior: an app collection is visible but a user still receives AccessDenied when launching an unassigned finance app. Address the underlying mechanism with: create appropriate enterprise application collections and include the relevant finance apps for targeted users. Then confirm: open My Apps as a pilot employee and verify the collection appears while existing app access remains unchanged.
Incorrect Answers
A:This diagnosis fits a separate scim application provisioning incident: The user can SSO to the app but no SaaS account is created through lifecycle provisioning. It does not explain this case's observed failure; application collection organization does not create enterprise application authorization or assignments.
B:This diagnosis fits a separate provisioning log troubleshooting incident: User assignment is correct but the application SCIM request repeatedly returns unauthorized. It does not explain this case's observed failure; application collection organization does not create enterprise application authorization or assignments.
D:This diagnosis fits a separate application tenant-wide admin consent incident: A developer's individual user consent succeeds for delegated access but an unattended daemon still lacks application permissions. It does not explain this case's observed failure; application collection organization does not create enterprise application authorization or assignments.
Question 322
Employees see a cluttered My Apps portal and want related finance applications grouped for easier discovery without changing who is authorized. The initial implementation works. Which continuing control most directly prevents the same failure or drift from recurring?
- Regularly review tenant-wide grants and remove stale application permissions.
- Monitor provisioning failures and offboarding deprovisioning separately from SSO success.
- Review app collection membership separately from the application-role assignment process.
- Manage signing certificate rollover and keep application endpoints in an approved change record.
Explanation
Correct Answer
C:Review app collection membership separately from the application-role assignment process. This reduces future drift after the initial control is deployed: create appropriate enterprise application collections and include the relevant finance apps for targeted users. Recheck the actual behavior with: open My Apps as a pilot employee and verify the collection appears while existing app access remains unchanged.
Incorrect Answers
A:This control manages future application tenant-wide admin consent drift, but it does not reduce the continuing exposure in the described enterprise app collections case. The correct safeguard is: review app collection membership separately from the application-role assignment process.
B:This control manages future scim application provisioning drift, but it does not reduce the continuing exposure in the described enterprise app collections case. The correct safeguard is: review app collection membership separately from the application-role assignment process.
D:This control manages future saml enterprise app setup drift, but it does not reduce the continuing exposure in the described enterprise app collections case. The correct safeguard is: review app collection membership separately from the application-role assignment process.
Question 323
A custom enterprise app exposes Reader and Approver roles, and a user must receive only Reader privileges. Which proposed configuration or implementation directly meets the stated requirement?
- Configure the enterprise application's supported SAML single sign-on with the correct identifier, reply URL and certificate exchange.
- Set assignment required for the enterprise application and assign authorized users/groups to available app roles.
- Configure supported automatic provisioning with an application SCIM endpoint, credentials and scoped user/group assignments.
- Assign the user's approved group to the Reader app role on the enterprise application.
Explanation
Correct Answer
D:Assign the user's approved group to the Reader app role on the enterprise application. The solution acts at the intended identity, policy or application scope. A successful result is testable: check the resulting token's role claim or app-side effective permissions for the test user. The competing configuration error is: the group was associated with the wrong application role instead of Reader.
Incorrect Answers
A:That action implements the separate saml enterprise app setup decision. It is appropriate when a company onboards a SAML 2.0 HR SaaS app and wants employees to use Microsoft Entra for single sign-on. The present case instead requires the specific application app role assignment change: assign the user's approved group to the Reader app role on the enterprise application.
B:That action implements the separate enterprise app user assignment requirement decision. It is appropriate when a sensitive enterprise app should be accessible only to staff explicitly assigned to it, not every authenticated tenant user. The present case instead requires the specific application app role assignment change: assign the user's approved group to the Reader app role on the enterprise application.
C:That action implements the separate scim application provisioning decision. It is appropriate when new employees should automatically receive and remove accounts in a SaaS application based on their assigned Entra group. The present case instead requires the specific application app role assignment change: assign the user's approved group to the Reader app role on the enterprise application.
Question 324
A custom enterprise app exposes Reader and Approver roles, and a user must receive only Reader privileges. The proposed change is: Assign the user's approved group to the Reader app role on the enterprise application. After applying the intended configuration, which observation most directly proves that the required behavior works?
- Inspect the service principal's permission grants and run a controlled API operation with the approved app role.
- Verify an unassigned test employee is denied while an assigned employee can sign in.
- Launch a test user sign-in and check the SaaS assertion consumer accepts signed claims for the correct audience.
- Check the resulting token's role claim or app-side effective permissions for the test user.
Explanation
Correct Answer
D:Check the resulting token's role claim or app-side effective permissions for the test user. This directly tests the effective outcome, not merely that a configuration exists. It establishes whether the intended change works: assign the user's approved group to the Reader app role on the enterprise application. Failure would be evident in this case: a user appears assigned to the application but receives Approver permissions after group reassignment.
Incorrect Answers
A:The proposed observation checks the different application tenant-wide admin consent scenario. Even a successful test would not establish the requested outcome here: check the resulting token's role claim or app-side effective permissions for the test user.
B:The proposed observation checks the different enterprise app user assignment requirement scenario. Even a successful test would not establish the requested outcome here: check the resulting token's role claim or app-side effective permissions for the test user.
C:The proposed observation checks the different saml enterprise app setup scenario. Even a successful test would not establish the requested outcome here: check the resulting token's role claim or app-side effective permissions for the test user.
Question 325
A user appears assigned to the application but receives Approver permissions after group reassignment. Which root cause best explains the described result rather than merely treating its symptoms?
- Delegated user consent did not authorize the requested application-only roles in the customer tenant.
- The group was associated with the wrong application role instead of Reader.
- The enterprise application has no user assignment requirement, allowing broader sign-in than intended.
- SAML sign-in configuration alone does not enable SCIM provisioning or scope the user into it.
Explanation
Correct Answer
B:The group was associated with the wrong application role instead of Reader. This is the causal explanation of the observed behavior: a user appears assigned to the application but receives Approver permissions after group reassignment. Address the underlying mechanism with: assign the user's approved group to the Reader app role on the enterprise application. Then confirm: check the resulting token's role claim or app-side effective permissions for the test user.
Incorrect Answers
A:This diagnosis fits a separate application tenant-wide admin consent incident: A developer's individual user consent succeeds for delegated access but an unattended daemon still lacks application permissions. It does not explain this case's observed failure; the group was associated with the wrong application role instead of Reader.
C:This diagnosis fits a separate enterprise app user assignment requirement incident: An employee can authenticate to the app even though they are not in the approved access roster. It does not explain this case's observed failure; the group was associated with the wrong application role instead of Reader.
D:This diagnosis fits a separate scim application provisioning incident: The user can SSO to the app but no SaaS account is created through lifecycle provisioning. It does not explain this case's observed failure; the group was associated with the wrong application role instead of Reader.
Question 326
A custom enterprise app exposes Reader and Approver roles, and a user must receive only Reader privileges. Select TWO complementary decisions: the correct technical implementation and the ongoing preventive control. Evidence-only tests and controls for a different scenario are not substitutes for those two responsibilities.
- Assign the user's approved group to the Reader app role on the enterprise application.
- Configure supported automatic provisioning with an application SCIM endpoint, credentials and scoped user/group assignments.
- Require enterprise application assignment but bind the intended Reader group to Approver instead of its Reader app role.
- Audit role-value changes and app assignments at each privileged application release.
- Reconcile application group assignments with HR departures and access reviews.
Explanation
Correct Answers
A:Assign the user's approved group to the Reader app role on the enterprise application. The solution acts at the intended identity, policy or application scope. A successful result is testable: check the resulting token's role claim or app-side effective permissions for the test user. The competing configuration error is: the group was associated with the wrong application role instead of Reader.
D:Audit role-value changes and app assignments at each privileged application release. This reduces future drift after the initial control is deployed: assign the user's approved group to the Reader app role on the enterprise application. Recheck the actual behavior with: check the resulting token's role claim or app-side effective permissions for the test user.
Incorrect Answers
B:That action implements the separate scim application provisioning decision. It is appropriate when new employees should automatically receive and remove accounts in a SaaS application based on their assigned Entra group. The present case instead requires the specific application app role assignment change: assign the user's approved group to the Reader app role on the enterprise application.
C:Assignment Required restricts who can enter, but mapping the Reader group to Approver grants the wrong application permissions.
E:This control manages future enterprise app user assignment requirement drift, but it does not reduce the continuing exposure in the described application app role assignment case. The correct safeguard is: audit role-value changes and app assignments at each privileged application release.
Question 327
An employee was assigned to an enterprise application yesterday but their SaaS account is missing, and the sign-in log contains no provisioning details. Which proposed configuration or implementation directly meets the stated requirement?
- Configure supported automatic provisioning with an application SCIM endpoint, credentials and scoped user/group assignments.
- Set assignment required for the enterprise application and assign authorized users/groups to available app roles.
- Configure the enterprise application's supported SAML single sign-on with the correct identifier, reply URL and certificate exchange.
- Investigate enterprise application provisioning logs and synchronization scope/error status for that identity.
Explanation
Correct Answer
D:Investigate enterprise application provisioning logs and synchronization scope/error status for that identity. The solution acts at the intended identity, policy or application scope. A successful result is testable: find the user's create/update job record and the target endpoint result rather than assuming SSO events prove provisioning. The competing configuration error is: the provisioning credential or endpoint authorization has expired or become invalid.
Incorrect Answers
A:That action implements the separate scim application provisioning decision. It is appropriate when new employees should automatically receive and remove accounts in a SaaS application based on their assigned Entra group. The present case instead requires the specific provisioning log troubleshooting change: investigate enterprise application provisioning logs and synchronization scope/error status for that identity.
B:That action implements the separate enterprise app user assignment requirement decision. It is appropriate when a sensitive enterprise app should be accessible only to staff explicitly assigned to it, not every authenticated tenant user. The present case instead requires the specific provisioning log troubleshooting change: investigate enterprise application provisioning logs and synchronization scope/error status for that identity.
C:That action implements the separate saml enterprise app setup decision. It is appropriate when a company onboards a SAML 2.0 HR SaaS app and wants employees to use Microsoft Entra for single sign-on. The present case instead requires the specific provisioning log troubleshooting change: investigate enterprise application provisioning logs and synchronization scope/error status for that identity.
Question 328
An employee was assigned to an enterprise application yesterday but their SaaS account is missing, and the sign-in log contains no provisioning details. The proposed change is: Investigate enterprise application provisioning logs and synchronization scope/error status for that identity. After applying the intended configuration, which observation most directly proves that the required behavior works?
- Inspect the service principal's permission grants and run a controlled API operation with the approved app role.
- Find the user's create/update job record and the target endpoint result rather than assuming SSO events prove provisioning.
- Launch a test user sign-in and check the SaaS assertion consumer accepts signed claims for the correct audience.
- Inspect provisioning logs for create, update and deprovision operations for a controlled test user.
Explanation
Correct Answer
B:Find the user's create/update job record and the target endpoint result rather than assuming SSO events prove provisioning. This directly tests the effective outcome, not merely that a configuration exists. It establishes whether the intended change works: investigate enterprise application provisioning logs and synchronization scope/error status for that identity. Failure would be evident in this case: user assignment is correct but the application SCIM request repeatedly returns unauthorized.
Incorrect Answers
A:The proposed observation checks the different application tenant-wide admin consent scenario. Even a successful test would not establish the requested outcome here: find the user's create/update job record and the target endpoint result rather than assuming SSO events prove provisioning.
C:The proposed observation checks the different saml enterprise app setup scenario. Even a successful test would not establish the requested outcome here: find the user's create/update job record and the target endpoint result rather than assuming SSO events prove provisioning.
D:The proposed observation checks the different scim application provisioning scenario. Even a successful test would not establish the requested outcome here: find the user's create/update job record and the target endpoint result rather than assuming SSO events prove provisioning.
Question 329
User assignment is correct but the application SCIM request repeatedly returns unauthorized. Which root cause best explains the described result rather than merely treating its symptoms?
- SAML sign-in configuration alone does not enable SCIM provisioning or scope the user into it.
- Application collection organization does not create enterprise application authorization or assignments.
- The enterprise application has no user assignment requirement, allowing broader sign-in than intended.
- The provisioning credential or endpoint authorization has expired or become invalid.
Explanation
Correct Answer
D:The provisioning credential or endpoint authorization has expired or become invalid. This is the causal explanation of the observed behavior: user assignment is correct but the application SCIM request repeatedly returns unauthorized. Address the underlying mechanism with: investigate enterprise application provisioning logs and synchronization scope/error status for that identity. Then confirm: find the user's create/update job record and the target endpoint result rather than assuming SSO events prove provisioning.
Incorrect Answers
A:This diagnosis fits a separate scim application provisioning incident: The user can SSO to the app but no SaaS account is created through lifecycle provisioning. It does not explain this case's observed failure; the provisioning credential or endpoint authorization has expired or become invalid.
B:This diagnosis fits a separate enterprise app collections incident: An app collection is visible but a user still receives AccessDenied when launching an unassigned finance app. It does not explain this case's observed failure; the provisioning credential or endpoint authorization has expired or become invalid.
C:This diagnosis fits a separate enterprise app user assignment requirement incident: An employee can authenticate to the app even though they are not in the approved access roster. It does not explain this case's observed failure; the provisioning credential or endpoint authorization has expired or become invalid.
Question 330
An employee was assigned to an enterprise application yesterday but their SaaS account is missing, and the sign-in log contains no provisioning details. The initial implementation works. Which continuing control most directly prevents the same failure or drift from recurring?
- Regularly review tenant-wide grants and remove stale application permissions.
- Audit role-value changes and app assignments at each privileged application release.
- Monitor provisioning failures and offboarding deprovisioning separately from SSO success.
- Monitor provisioning error rates and credential rotation for connected apps.
Explanation
Correct Answer
D:Monitor provisioning error rates and credential rotation for connected apps. This reduces future drift after the initial control is deployed: investigate enterprise application provisioning logs and synchronization scope/error status for that identity. Recheck the actual behavior with: find the user's create/update job record and the target endpoint result rather than assuming SSO events prove provisioning.
Incorrect Answers
A:This control manages future application tenant-wide admin consent drift, but it does not reduce the continuing exposure in the described provisioning log troubleshooting case. The correct safeguard is: monitor provisioning error rates and credential rotation for connected apps.
B:This control manages future application app role assignment drift, but it does not reduce the continuing exposure in the described provisioning log troubleshooting case. The correct safeguard is: monitor provisioning error rates and credential rotation for connected apps.
C:This control manages future scim application provisioning drift, but it does not reduce the continuing exposure in the described provisioning log troubleshooting case. The correct safeguard is: monitor provisioning error rates and credential rotation for connected apps.
Microsoft Identity and Access Administrator (SC-300) Practice Tests