The Azure Active Directory (Azure AD) tenant contains the groups shown in the following table.
In Azure AD, you add a new enterprise application named App1.
Which groups can you assign to App1?
SC-300 Exam QuestionsBrowse all questions from this exam
SC-300 Exam - Question 226
Show AnswerHide Answer
Correct Answer: D
In Azure AD, only Security groups and Mail-enabled security groups can be assigned to an enterprise application. Security groups (Group1) are primarily used for managing access permissions, and Mail-enabled security groups (Group4) provide the same functionality with the additional benefit of email capabilities. Distribution groups (Group2) and Microsoft 365 groups (Group3) are primarily used for email distribution and collaboration, and thus, are not suitable for application assignment. Therefore, among the options provided, only Group1 and Group4 can be assigned to the application.
Discussion
40 commentsHelloItsSam
Feb 16, 2023MS documentation is not up to date! Just tested in my tenant, all the below groups are supported 1- Security 2- Microsoft 365 3- Mail-Enabled security Group
Arjanussie
Mar 3, 2023I did the same test and indeed Hello is right
f2bf85a
Apr 23, 2023I was also able to add a distribution list as an assigned group to an enterprise app. It seems like the prerequisite is the attribute "securityEnabled" is not necessary either. If you create M365 from Microsoft Admin center, securityEnabled attribute is by default set to No, but if you create M365 groups from Azure AD portal or Entra, securityEnabled is set to Yes. But nevertheless, I could add all groups as assignments to the enterprise App.
oopspruu
Sep 7, 2023Source: https://learn.microsoft.com/en-us/azure/active-directory/manage-apps/assign-user-or-group-access-portal?pivots=portal
HartMS
Apr 13, 2024I tested and was able to add all three mentioned groups
oopspruuOption: E
Sep 7, 2023As of today, 9/6/2023: "Group-based assignment requires Azure Active Directory Premium P1 or P2 edition. Group-based assignment is supported for Security groups and Microsoft 365 groups whose SecurityEnabled setting is set to True only." Answer is correct.
itismaduOption: E
Oct 27, 2023E according tohttps://learn.microsoft.com/en-us/azure/active-directory/manage-apps/assign-user-or-group-access-portal?pivots=portal
ACSC
Sep 27, 2023Answer: E Group-based assignment requires Microsoft Entra ID P1 or P2 edition. Group-based assignment is supported for Security groups and Microsoft 365 groups whose SecurityEnabled setting is set to True only. Nested group memberships aren't currently supported. https://learn.microsoft.com/en-us/azure/active-directory/manage-apps/assign-user-or-group-access-portal?pivots=portal
SaynotOption: E
Feb 22, 2024Group-based assignment is supported for Security groups and Microsoft 365 groups whose SecurityEnabled setting is set to True only
JN_311Option: E
Jun 8, 2023I tested adding M365 Group, was able to add group to enterprise app. Also the doco states it as well. https://learn.microsoft.com/en-us/azure/active-directory/manage-apps/assign-user-or-group-access-portal?pivots=portal Group-based assignment requires Azure Active Directory Premium P1 or P2 edition. Group-based assignment is supported for Security groups and Microsoft 365 groups whose SecurityEnabled setting is set to True only.
nsotis28
Nov 17, 2022tested on my tenant . M365 group is listed and can be selected. Members of that group have access to App
Jhill777
Dec 1, 2022No you didn't.
Jhill777Option: D
Dec 1, 2022Only security groups and mail-enabled security groups.
anuj530Option: E
Dec 30, 2022Just tested this and you can indeed assign it to Security and MS365 groups. I also checked the access and users in the 365 groups do have access to the app. https://learn.microsoft.com/en-us/azure/active-directory/enterprise-users/groups-saasapps This article states "For example, if you want to assign access for the marketing department to use five different SaaS applications, you can create an Office 365 or security group that contains the users in the marketing department, and then assign that group to these five SaaS applications that are needed by the marketing department. "
KRISTINMERIEANNOption: E
Apr 10, 2024according tohttps://learn.microsoft.com/en-us/azure/active-directory/manage-apps/assign-user-or-group-access-portal?pivots=portal
BRZSZCL
Oct 29, 2024I have tested also and these 3 groups i can add, Gropup 1 (Security), Group 3(Microsoft 365) and Group 4 (Mail-enabled Security), but it could never be Distribution list, some answers shows that distribution list can also be added but it is 100% wrong
prelek1984
Sep 14, 2022checked - you can't add M365 groups
Teplah
Oct 11, 2022I just did....
Teplah
Oct 11, 2022Just to add: adding M365 group to the app didn't flag any error. I believe the user experience will come up with the error since MS doc advised Security Groups only. https://learn.microsoft.com/en-us/azure/active-directory/manage-apps/assign-user-or-group-access-portal
Teplah
Oct 11, 2022Just to add: adding M365 group to the app didn't flag any error. I believe the user experience will come up with the error since MS doc advised Security Groups only. https://learn.microsoft.com/en-us/azure/active-directory/manage-apps/assign-user-or-group-access-portal
makovec25Option: D
Sep 26, 2022only Security group and mail enabled Security group can be assigned.
MoezeyOption: D
Oct 3, 2022Group 1 and Group 4 only
hellboyczeOption: D
Dec 28, 2022Only security groups and mail-enabled security groups. M365 groups are not allowed
shouro88
Jan 18, 2023tested in lab, can add m365 group to an enterprise app
dochOption: D
Jan 24, 2023Sure. - Group-based assignment is supported for Security groups only. - Nested group memberships and Microsoft 365 groups aren't currently supported. https://learn.microsoft.com/en-us/azure/active-directory/manage-apps/assign-user-or-group-access-portal?pivots=portal
dizarm
Feb 8, 2023Just testet, and able to add Security, Microsoft 365 both assigned and dynamic and Security Mail-enabled. Not able to answer correctly.
f2bf85a
Apr 23, 2023Tested it in my lab: Seems like the question is outdated... I was able to add all four kinds of groups (mail-enabled security, security, M365, distribution)
dule27Option: D
Jul 3, 2023Group1, Group 3 and Group 4
Sc300ExamDemo
May 22, 2024From azure portal, only security and m365 group type can be seen when adding to ent apps.
LabelfreeOption: D
Nov 19, 2024D. Groups1 and Groups4 is correct in this scenario. Yes, all except for the distribution group option here CAN be assigned, but we are to assume default settings for these questions unless otherwise specified. Once you've looked into this question a little ask yourself this question and you'll realize the solution: What is the default setting for Microsoft 365 "SecurityEnabled" flag? To use a Microsoft 365 Group for security-related tasks, such as application assignments or Conditional Access policies, the SecurityEnabled property must be explicitly set to True.
Cams420Option: D
Dec 28, 2024Following default settings, it should be D.
Frank9020
Jan 30, 2025Sorry, but you are incorrect: Group4 (Mail-Enabled Security Group) Can't be assigned to Apps: You may claim that mail-enabled security groups can be assigned to apps because they are used for both email communication and security-related tasks. However, in Azure AD, there is a key limitation: Azure AD Does Not Support Mail-Enabled Security Groups for App Assignments: These groups are primarily used for assigning permissions in Exchange Online, SharePoint, and other Microsoft 365 services. However, they cannot be used for role-based access control (RBAC) or application assignments in Azure AD. Unlike standard security groups, mail-enabled security groups do not sync properly with Azure AD role assignments, making them ineligible for app access assignments.
Dragi
Sep 8, 2022It looks like only Security group can be assigned. https://docs.microsoft.com/en-us/azure/active-directory/manage-apps/assign-user-or-group-access-portal Only Security groups are listed when I tested. I still have to test with mail-enabled Security groups.
birrachOption: D
Sep 8, 2022"Group-based assignment requires Azure Active Directory Premium P1 or P2 edition. Group-based assignment is supported for Security groups only." Source: https://docs.microsoft.com/en-us/azure/active-directory/manage-apps/assign-user-or-group-access-portal
Hot_156Option: D
Oct 4, 2022Security groups!
msaeed81
Oct 11, 2022You can assing Security and 365 groups both, not sure why people here saying only security group and where are they testing.
kerimnl
Oct 31, 2022https://learn.microsoft.com/en-us/azure/active-directory/manage-apps/assign-user-or-group-access-portal#:~:text=group%20memberships%20and-,Microsoft%20365%20groups,-are%20not%20currently
kerimnlOption: D
Oct 31, 2022Group-based assignment requires Azure Active Directory Premium P1 or P2 edition. Group-based assignment is supported for Security groups only. Nested group memberships and Microsoft 365 groups are NOT CURRENTLY SUPPORTED. Source: https://learn.microsoft.com/en-us/azure/active-directory/manage-apps/assign-user-or-group-access-portal#:~:text=group%20memberships%20and-,Microsoft%20365%20groups,-are%20not%20currently
jack987Option: D
Dec 27, 2022The correct answer is D: Group-based assignment requires Azure Active Directory Premium P1 or P2 edition. Group-based assignment is supported for Security groups only. Nested group memberships and Microsoft 365 groups aren't currently supported. https://learn.microsoft.com/en-us/azure/active-directory/manage-apps/assign-user-or-group-access-portal?pivots=portal
HalwagyOption: A
Jan 26, 2023Group 1 only, as you cannot add APP to Mail-enabled security group , as Mail-Enabled security group assignment is handled from Exchange not from Azure AD.
Halwagy
Jan 29, 2023my Mistake, I understood wrongly, recently , the following groups can be assigned to the EnterpriseApp, tested: Security, M365 Group, Mail-Enabled Security group
mayleniOption: D
Feb 12, 2023Docs says that "you can use this feature only after you start an Azure AD Premium trial or purchase Azure AD Premium license plan. Group-based assignment is supported only for security groups. Nested group memberships are not supported for group-based assignment to applications at this time."
LeTrinh
Feb 15, 2023Group 1 only. https://learn.microsoft.com/en-us/azure/active-directory/manage-apps/assign-user-or-group-access-portal?pivots=portal When you assign a group to an application, only users in the group will have access. The assignment doesn't cascade to nested groups. Group-based assignment requires Azure Active Directory Premium P1 or P2 edition. Group-based assignment is supported for Security groups only. Nested group memberships and Microsoft 365 groups aren't currently supported.
penatuna
Apr 21, 2023"Group-based assignment requires Azure Active Directory Premium P1 or P2 edition. Group-based assignment is supported for Security groups and Microsoft 365 groups whose SecurityEnabled setting is set to True only. Nested group memberships aren't currently supported." https://learn.microsoft.com/en-us/azure/active-directory/manage-apps/assign-user-or-group-access-portal?pivots=portal
TomasValtor
Jun 14, 2023You can use this feature only after you start an Azure AD Premium trial or purchase Azure AD Premium license plan. Group-based assignment is supported only for security groups. Nested group memberships are not supported for group-based assignment to applications at this time.
ANiMOSiTYOPOption: D
Mar 1, 2024Answer is D (Group1 and Group4) In Azure AD, you can only assign Security groups and Mail-enabled Security groups to an enterprise application. These types of groups have the necessary permissions for assigning to applications. Distribution groups and Microsoft 365 groups are used for different purposes like email communication and collaboration, and lack the necessary permissions that are required for application assignment. https://docs.microsoft.com/en-us/azure/active-directory/manage-apps/assign-user-or-group-access-portal In the "Assign a group" section, it mentions that "Any type of security group can be assigned to an application for the purposes of assigning users or groups to the app." This clarifies that Security Groups, and by extension Mail-enabled Security groups, can be assigned to an application. It doesn't mention Distribution groups or Microsoft 365 groups, which are not generally used for managing security or application assignments.
HartMSOption: D
Apr 13, 2024Answer D I tested and if you create M365 Group from Admin Centre, then I wasn't able to add it to the Enterprise application. If you create it from Azure portal you would be able to add it. You don't know where the M365 group was created, so it is better to play a safe bet going with Security group and mail-enabled security group.
JuanZ
Apr 18, 2024La asignación basada en grupos requiere la edición Microsoft Entra ID P1 o P2. La asignación basada en grupos se admite para grupos de seguridad y grupos de Microsoft 365 cuya SecurityEnabledconfiguración está establecida en Truesolo. Actualmente no se admiten membresías de grupos anidados
NICKTON81
Apr 27, 2024E. Group1 and Group3 Group-based assignment requires Microsoft Entra ID P1 or P2 edition. Group-based assignment is supported for Security groups and Microsoft 365 groups whose SecurityEnabled setting is set to True only. Nested group memberships aren't currently supported. https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/assign-user-or-group-access-portal?pivots=portal
martutene
Oct 16, 2024Group-based assignment requires Microsoft Entra ID P1 or P2 edition. Group-based assignment is supported for Security groups, Microsoft 365 groups, and Distribution groups whose SecurityEnabled setting is set to True only. https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/assign-user-or-group-access-portal?pivots=portal
Obi_Wan_JacobyOption: E
Apr 15, 2025Answer is E. Security groups: Azure Resources: Security groups can be used to manage access to Azure resources such as virtual machines, databases, and other services. SharePoint Sites: They can control access to SharePoint sites and libraries. Applications: Security groups can be assigned to enterprise applications in Azure AD to manage user access. Licenses: They can be used to assign licenses to users. Mail-enabled security groups: Email Distribution: These groups are primarily used for email distribution and can also grant access permissions to resources in Active Directory. Exchange Online: They are managed through the Exchange admin center and are used for both email distribution and security
Obi_Wan_Jacoby
Apr 15, 2025While both types of groups can manage access to certain resources, security groups have broader capabilities within Azure AD and are more versatile for managing access to a wide range of Azure resources and applications