Exam SC-300 topic 4 question 68 discussion

Correct answer is B "Permissions Management has its own group-based access system that provides granular control over what cloud environments, authorization systems, and permissions users have access to. The settings to manage these areas are found under the User Management tab of the product, which is in your profile dropdown menu." https://learn.microsoft.com/en-us/training/permissions-management/explore-features-of-permissions-management/13-manage-access-to-microsoft-entra-permissions-management Then, you can see from the screenshots that you have the option to search for AAD Security groups to add permissions.

"Permissions Management entitlements work through group-based access. To add a new user, you must add a user to a group through Microsoft Entra ID." https://learn.microsoft.com/en-us/entra/permissions-management/how-to-add-remove-user-to-group https://learn.microsoft.com/en-us/answers/questions/1504869/how-to-grant-end-user-reader-access-to-entra-permi

Answer: B. I hate questions like this. Yes, you can assign a role to grant access (Answer D) and might technically be less effort, but not in the long run. We all know it's easier to keep track of and manage that group membership when others need to be added/removed from the access. Also based on the "model" of the whole thing (based on security groups for the access). And that little "What should you do first?" in the question makes you think that it is not a one step solution overall which points to B. I gotta pay attention to that little detail when I read these questions, it is so easy for your eyes to skim over that last (sometimes crucial) detail.

Answer B) From the Microsoft Entra admin center, create a security group To effectively manage permissions, add users to security groups before assigning permissions, using a "group-centric" approach. This simplifies management, reduces complexity, and promotes easier auditing and troubleshooting.

The correct answer is D. From the Microsoft Entra admin center, assign a role to User1. To provide User1 with access to Permissions Management while following the principle of least privilege and minimizing administrative effort, you should first assign a role to User1 from the Microsoft Entra admin center. This ensures that User1 has the necessary permissions to access and manage Permissions Management without granting excessive privileges.

Correct Answer is D If only User1 needs access, assigning a role directly (option D) would still be the most straightforward solution. However, if you anticipate that more users will need similar access in the future, your approach with a security group could be a better long-term strategy.

D is the correct answer. Some of you are saying B, but where are we assigning anything in B? We are simply creating a group without assigning it anything, so the user still has no rights in that selection. We can grant the specific required role, providing least privilege and what's required of the question/user.

B. From the Microsoft Entra admin center, create a security group. To provide User1 with access to Microsoft Entra Permissions Management while following the principle of least privilege and minimizing administrative effort, you should first create a security group in the Microsoft Entra admin center. Once the security group is created, you can assign appropriate permissions or roles to it within Permissions Management. This approach allows for centralized management of access control and facilitates easier management of permissions for multiple users by simply adding or removing them from the security group as needed.

The Microsoft Entra admin center is a portal that allows you to manage your Microsoft Entra products and services, such as Permissions Management, Identity Governance, and Privileged Identity Management. You can assign roles to users or groups to grant them access to specific features and functions in Microsoft Entra.