Exam SC-300 topic 3 question 6 discussion

Actually I think correct answers are: All users Assigned user in users and groups blade https://docs.microsoft.com/en-us/azure/active-directory/manage-apps/add-application-portal-configure

the answers are all users all users

Given asnwers are correct (others explain correctly)

as per the recent doc, it should be. 1. all users 2. only users listed in user and gorup blade. the reason for bullet point 2. is in the help section of ' Assignment required' If this option is set to yes, then users and other apps or services must first be assigned this application before being able to access it. If this option is set to no, then all users will be able to sign in, and other apps and services will be able to obtain an access token to this service. pl. see the excerpts below. This option does not affect whether or not an application appears on My Apps. To show the application there, assign an appropriate user or group to the application.

=>Enabled for users to sign-in? If this option is set to yes (our case), then assigned users will be able to sign in to this application, either from My Apps, the User access URL, or by navigating to the application URL directly. If this option is set to no, then no users will be able to sign in to this app, even if they are assigned to it. => All users Visible to users? if this option is set to yes (our case), then assigned users will see the application on My Apps and O365 app launcher. If this option is set to no, then no users will see this application on their My Apps and O365 launcher. => All users

All Users Users listed in Users and Groups Blade

I think this is for both all users. The option user assignment required is set to no which means all users have access. So both answers is all users

All users Assigned user in users and groups blade

All users Only users listed on the users and groups blade

Enabled for users to sign in? Yes User assignment required? No Visible to users? Yes Assigned users can see the app and sign in. Unassigned users can't see the app but can sign in All users Assigned user in users and groups blade

Wrong. 1/ Can access App1 -> All user Because Users to sign in is enable AND user assignment require is NO. 2/ Only users listed on the Owner blade - Visible to users is YES -> visible to assign users ONLY, which is the Owner. https://learn.microsoft.com/en-us/training/modules/plan-design-integration-of-enterprise-apps-for-sso/7-configure-pre-integrated-gallery-saas-apps

The answer is correct. All users can access App1 from the homepage URL. App1 will appear in the Microsoft O365 app launcer for no one. When user assignment is not required, unassigned users don't see the app on their My Apps, but they can still sign in to the application itself (also known as SP-initiated sign-on) or they can use the User Access URL in the application’s Properties page (also known as IDP-initiated sign on). For more information on requiring user assignment configurations, See Configure an application This setting doesn't affect whether or not an application appears on My Apps. Applications appear on users' My Apps access panels once you've assigned a user or group to the application. https://learn.microsoft.com/en-us/azure/active-directory/manage-apps/what-is-access-management#requiring-user-assignment-for-an-app

All users can access App1 from homepage URL Only users listed on Users and groups- since not assigned will not appear in my apps portal.

1- All users 2- Only users listed on the users and groups blade. for the second option -User assignment required :- This option does not affect whether or not an application appears on My Apps. To show the application there, assign an appropriate user or group to the application.

IMO, the two settings should be treated independently of each other First question: All Users. If 'assignment required' set to no, any user can login using the app url Second Question: Only users assigned in users and groups blade. If 'Visible to Users' is Yes, then assigned users will see the application on My Apps and O365 app launcher. If this set to no, then no users will see this application on their My Apps and O365 Launcher

The link from user Dipronil helps to make sense of this. 1# All users, because "Enable for users to sign-in" is selected and "User assignment required" is set to to No. 2# No one, because unless you are assigned to the app explicitly "as per URL; https://docs.microsoft.com/en-us/azure/active-directory/manage-apps/assign-user-or-group-access-portal" No one is able to see the app, this is irrespective if "Visible to user is specified".

Reference: https://docs.microsoft.com/en-us/azure/active-directory/manage-apps/what-is-access-management#requiring-user-assignment-for-an-app When user assignment is required, only those users you assign to the application (either through direct user assignment or based on group membership) are able to sign in. They can access the app on the My Apps portal or by using a direct link. When user assignment is not required, unassigned users don't see the app on their My Apps, but they can still sign in to the application itself (also known as SP-initiated sign-on) or they can use the User Access URL in the application’s Properties page (also known as IDP-initiated sign on). For more information on requiring user assignment configurations, See Configure an application