You have a Microsoft Entra tenant that contains the users shown in the following table. You add an enterprise application named App1 and configure the following Self-service settings: - Allow users to request access to this application: Yes - To which group should assigned users be added: Group1 - Require approval before granting access to this application: Yes - Who is allowed to approve access to this application: User2 Which users can request access to App1?

Microsoft

SC-300 · Question #320

You have a Microsoft Entra tenant that contains the users shown in the following table. You add an enterprise application named App1 and configure the following Self-service settings: - Allow users…

The correct answer is D. User1, User2, and User3. Option D is correct because the Self-service setting "Allow users to request access to this application: Yes" applies to all users in the tenant - there is no restriction limiting who can request access, only who can approve it. User1, User2, and User3 are all members of the…

Submitted by ngozi_ng· Mar 6, 2026Implement access management for apps

Question

You have a Microsoft Entra tenant that contains the users shown in the following table. You add an enterprise application named App1 and configure the following Self-service settings:

Allow users to request access to this application: Yes
To which group should assigned users be added: Group1
Require approval before granting access to this application: Yes
Who is allowed to approve access to this application: User2

Which users can request access to App1?

Options

AUser3 only
BUser2 and User3 only
CUser1 and User3 only
DUser1, User2, and User3

How the community answered

(38 responses)

A
3% (1)
B
5% (2)
C
3% (1)
D
89% (34)

Explanation

Option D is correct because the Self-service setting "Allow users to request access to this application: Yes" applies to all users in the tenant - there is no restriction limiting who can request access, only who can approve it. User1, User2, and User3 are all members of the tenant, so all three can submit a request for App1.

Why the distractors are wrong:

Option A (User3 only) incorrectly assumes that because User2 is the approver, they cannot also request access - but being an approver does not disqualify you from requesting access yourself.
Option B (User2 and User3 only) and Option C (User1 and User3 only) both incorrectly exclude one user, likely confusing roles (approver, group member, etc.) with request eligibility - these roles affect approval and group assignment, not the ability to request.

Memory tip: Think of Self-service access in two separate lanes - the request lane (open to everyone in the tenant unless restricted) and the approval lane (restricted to designated approvers). The configuration settings control approval, group assignment, and who approves, but not who can request, unless explicitly scoped.

Topics

#Microsoft Entra ID#Enterprise Applications#Self-service access#Application access management

Community Discussion

No community discussion yet for this question.

Full SC-300 Practice