SC-300 Questions Bank

According to the Microsoft SC-300: Microsoft Identity and Access Administrator Study Guide and Microsoft Learn documentation on Azure AD group assignments for enterprise applications, only specific group types in Azure AD can be assigned to enterprise applications (service principals).

Azure AD allows group-based assignment for enterprise applications only when the group is a Security group or a Mail-enabled security group. This is because Azure AD uses security groups for authorization purposes.

Let’s analyze the groups from the table:

Group

Type

Assignable to App1?

Reason

Group1

Security

✅ Yes

Security groups are used for managing access permissions and can be assigned to apps.

Group2

Distribution

❌ No

Distribution groups are used for email distribution lists and cannot be used for access management.

Group3

Microsoft 365

❌ No

Microsoft 365 (formerly Office 365) groups manage collaboration resources like Teams and SharePoint but are not supported for enterprise app assignments.

Group4

Mail-enabled security

✅ Yes

Mail-enabled security groups combine mailing capabilities with security functionality and can be used to assign permissions to applications.

The Microsoft documentation states:

“You can assign access to enterprise applications in Azure AD to users, security groups, and mail-enabled security groups. Distribution lists and Microsoft 365 groups are not supported for app assignments.”

Thus, for App1, which is an enterprise application, you can assign only Group1 (Security) and Group4 (Mail-enabled Security).