Prevent High-Privilege App Consent: What to Modify First

SC-300 By islever Editorial Last updated

Plan, implement, and monitor the integration of enterprise applications

Short answer

B Configure permission classifications first so high-privilege delegated permissions are labeled high impact and low-risk permissions low impact, then enforce selected-permission user consent.

Question

You have a Microsoft Entra tenant.
You need to ensure that users are prevented from consenting to high-privilege permission requests for enterprise applications. The solution must ensure that the users can consent to low-risk permission requests.
What should you modify first?
  1. Admin consent settings
  2. Permission classifications Correct Answer
  3. User consent settings
  4. App registrations

Key Takeaways

It tests the dependency between permission classifications and the selected-permissions user-consent option; the trap is choosing user consent settings first because that is the visible enforcement control.

This SC-300 scenario asks which setting to change before restricting enterprise app user consent to low-risk permissions. The correct first step is permission classifications (B), followed by the selected-permission user consent setting.

Common mistake: The most plausible wrong answer is C, user consent settings, because it directly controls user consent; however, the selected-permissions option depends on low-impact classifications, so classifications must be defined first.

Expert Analysis

The qualifier that decides the order. The question does not ask for the setting that ultimately enforces consent; it asks what to modify first. The required outcome has two parts: block user consent for high-privilege requests and still allow low-risk requests. That maps to Entra's selected-permissions user-consent model, where the tenant must have impact labels that distinguish low-impact delegated permissions from high-impact ones. Those labels come from permission classifications.

Why B is the first modification. Permission classifications are the prerequisite data. Once permissions such as a broad Graph write scope are marked high impact and a narrow read scope is marked low impact, the user consent setting can use the "selected permissions" option and enforce exactly the requested split. Choosing B means you define the allow/deny boundary before you switch the policy that consumes it. The comments split between flipping user consent settings and classifying permissions; the better reading is to classify first, because the selected-permission option has no reliable low-risk allowlist until classifications exist.

Why C is close but not first. Option C, user consent settings, is the visible enforcement control and must be changed eventually. However, the wording "prevented from consenting to high-privilege" and "can consent to low-risk" requires a classification boundary; simply selecting a consent option without that boundary does not satisfy the requirement. Option A, admin consent settings, is about the admin consent request workflow, not end-user consent to delegated permissions. Option D, app registrations, defines application objects and API permissions for an app, but does not establish the tenant-wide enterprise-app consent policy. Thus B is the first setting to modify, followed by C.

Official Reference

These links open the official vendor documentation in a new tab.

Exam Strategy

When a question says "first" in Entra consent configuration, look for the prerequisite object that feeds the later policy option. Map each option to its blade: permission classifications define impact labels; user consent settings select who can consent; admin consent settings govern request workflows. If the requested outcome is "allow only low-risk," classify first, then set the user consent option to selected permissions. Do not pick the enforcement control just because it names consent.

Frequently Asked Questions

Why is user consent settings not the first change?

User consent settings is the enforcement control, but its selected-permissions option depends on permission classifications to identify low-impact requests. Classify permissions first, then choose the consent setting.

What happens when a permission is classified as high impact?

With selected-permission user consent, end users cannot consent to that permission; the request requires admin consent. Low-impact permissions remain eligible when the app meets the publisher or tenant conditions.

Do admin consent settings prevent user consent to high-privilege requests?

No. Admin consent settings govern the admin consent request workflow. User consent settings plus permission classifications determine which delegated permissions end users can approve.

More SC-300 FAQ →

Discussion 5 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 5

  1. KindFlame 👍 2 Answered B
    Permission classifications https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/configure-permission-classifications?tabs=azure-portal&pivots=portal
  2. Payday123 👍 1 Answered C
    Indeed First we need to choose: "Allow user consent for apps from verified publishers, for selected permissions All users can consent for permissions classified as "low impact", for apps from verified publishers or apps registered in this organization" and then create the permission classification
  3. sheilawu 👍 1 Answered B
    Before you configure a user consent, you need to set up policy classfication. https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/configure-user-consent?pivots=portal
  4. skirk1564 👍 1 Answered B
    The question asks what to do FIRST... so permissions is first then User consent settings are changed.
  5. Frippy 👍 1 Answered C
    https://learn.microsoft.com/en-us/security/zero-trust/develop/permissions-require-admin-consent

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

How Long Are Microsoft Entra Risky User Activity Logs Retained?

S-grade

Azure User-Assigned Managed Identity Regional Scope

S-grade

Which role for the Permissions Management service principal?

S-grade

Prerequisite for Microsoft Defender for Cloud Apps Session Policy

S-grade

Practice All SC-300 Questions

Access 80 questions with complete answers and detailed explanations.

View Full SC-300 Practice Test →

← Back to SC-300 Study Guide