What Should You Do First to Give a User Permissions Management Access?

Plan and implement privileged access

Answer Correct answer: B — Create a security group in the Microsoft Entra admin center first, because Microsoft Entra Permissions Management grants access only through Entra group membership.

You have an Azure subscription that contains a user named User1. The subscription is onboarded to Microsoft Entra Permissions Management. You need to provide User1 with access to Permissions Management. The solution must meet the following requirements: • Follow the principle of least privilege. • Minimize administrative effort. What should you do first?

From the Role/Policy Template subtab of Permissions Management, create a template.
From the Microsoft Entra admin center, create a security group. Correct Answer
From the My Requests subtab of Permissions Management, create a new request.
From the Microsoft Entra admin center, assign a role to User1.

entra permissions management access permissions management security group sc-300 least privilege access

Community Votes

65%

35%

65% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.

Community Insight

This question tests that Permissions Management access is group-based; the common trap is choosing direct role assignment to a user because it looks like least privilege with minimal effort.

Microsoft Entra Permissions Management grants product access through Microsoft Entra security groups, so the first step for User1 is creating a group in the Microsoft Entra admin center. This page confirms option B and explains why a direct Entra role assignment to the user does not satisfy the group-based access model.

Choosing D (assign a role directly to User1) because it seems to grant access in one step, but Permissions Management does not provide product-level access through direct user role assignment; it requires a Microsoft Entra security group first.

Community Discussion (8 comments)

Sneekygeek 👍 6 Selected: B

Correct answer is B "Permissions Management has its own group-based access system that provides granular control over what cloud environments, authorization systems, and permissions users have access to. The settings to manage these areas are found under the User Management tab of the product, which is in your profile dropdown menu." https://learn.microsoft.com/en-us/training/permissions-management/explore-features-of-permissions-management/13-manage-access-to-microsoft-entra-permissions-management Then, you can see from the screenshots that you have the option to search for AAD Security groups to add permissions.

penatuna 👍 6 Selected: B

"Permissions Management entitlements work through group-based access. To add a new user, you must add a user to a group through Microsoft Entra ID." https://learn.microsoft.com/en-us/entra/permissions-management/how-to-add-remove-user-to-group https://learn.microsoft.com/en-us/answers/questions/1504869/how-to-grant-end-user-reader-access-to-entra-permi

YesPlease 👍 1 Selected: B

Answer B) From the Microsoft Entra admin center, create a security group To effectively manage permissions, add users to security groups before assigning permissions, using a "group-centric" approach. This simplifies management, reduces complexity, and promotes easier auditing and troubleshooting.

Frank9020 👍 2 Selected: D

The correct answer is D. From the Microsoft Entra admin center, assign a role to User1. To provide User1 with access to Permissions Management while following the principle of least privilege and minimizing administrative effort, you should first assign a role to User1 from the Microsoft Entra admin center. This ensures that User1 has the necessary permissions to access and manage Permissions Management without granting excessive privileges.

dvmhike 👍 3

Correct Answer is D If only User1 needs access, assigning a role directly (option D) would still be the most straightforward solution. However, if you anticipate that more users will need similar access in the future, your approach with a security group could be a better long-term strategy.

Labelfree 👍 2 Selected: D

D is the correct answer. Some of you are saying B, but where are we assigning anything in B? We are simply creating a group without assigning it anything, so the user still has no rights in that selection. We can grant the specific required role, providing least privilege and what's required of the question/user.

dzdz 👍 1

B. From the Microsoft Entra admin center, create a security group. To provide User1 with access to Microsoft Entra Permissions Management while following the principle of least privilege and minimizing administrative effort, you should first create a security group in the Microsoft Entra admin center. Once the security group is created, you can assign appropriate permissions or roles to it within Permissions Management. This approach allows for centralized management of access control and facilitates easier management of permissions for multiple users by simply adding or removing them from the security group as needed.

Sozo 👍 3 Selected: D

The Microsoft Entra admin center is a portal that allows you to manage your Microsoft Entra products and services, such as Permissions Management, Identity Governance, and Privileged Identity Management. You can assign roles to users or groups to grant them access to specific features and functions in Microsoft Entra.

Comments & Corrections

No comments yet — spotted an error or have a note? Share it below.

Expert Analysis

Why the Answer Is Correct

Microsoft Entra Permissions Management does not grant product access by assigning a Microsoft Entra directory role directly to a user; it relies on group-based entitlements. To add User1, you must first create a Microsoft Entra security group in the Microsoft Entra admin center, add User1 to it, and then assign the required Permissions Management role (for example, Viewer or Administrator) to that group. Because the group becomes the unit of authorization, the role can be scoped to only the cloud environments and tasks User1 needs, which satisfies least privilege. This also minimizes future administrative effort: additional users can gain the same access by group membership rather than by repeating per-user assignments. Therefore the first action is creating the security group (B).

Why the Other Options Are Wrong

Option A (Role/Policy Template subtab) is about defining reusable Permissions Management templates for role and policy configuration, not about granting a specific user access; creating a template does not add User1 to the product. Option C (My Requests subtab) is a self-service request workflow for resources or roles, not the administrative first step to provision access, and it would still depend on the underlying group and role structure. Option D (assign a role directly to User1 from the Microsoft Entra admin center) is the most tempting distractor because it appears to follow least privilege with minimal steps, but Permissions Management access is group-based, so a direct Entra role assignment does not provide the granular product-level access this scenario requires. In short, D risks granting a broad directory role rather than least-privilege Permissions Management access, and it bypasses the required group membership.

Community Comment Notes

The majority of commenters (65 votes for B) support the group-first approach, and Sneekygeek points out that "Permissions Management has its own group-based access system" for granular control over cloud environments and permissions. Penatuna reinforces this with the official requirement that "Permissions Management entitlements work through group-based access" and that "you must add a user to a group through Microsoft Entra ID." A dissenting group (dvmhike, Sozo, Frank9020, Labelfree) argues for D, with Labelfree asking "where are we assigning anything in B?" and calling for direct role assignment to meet least privilege; however, their reasoning overlooks that the group creation is the prerequisite step and the Permissions Management role is assigned to the group afterward. The comments collectively confirm that the first action is creating the security group, not assigning the product role directly to User1.

Official Reference

https://learn.microsoft.com/en-us/entra/permissions-management/how-to-add-remove-user-to-group

Exam Strategy

When a Permissions Management question asks what to do first, think group-first: create a Microsoft Entra security group, then assign the Permissions Management role to that group. Direct role assignment to a user is a distractor because Permissions Management uses its own group-based access model.

Frequently Asked Questions

Why can't I assign a role directly to User1 for Permissions Management?

Permissions Management uses its own group-based access model; a direct user role assignment in Entra ID does not grant product access, so you must add the user to a security group first.

Does creating a security group really minimize administrative effort?

Yes, because you assign Permissions Management roles to the group once and then manage access by group membership, which is easier than repeating per-user role assignments as more users join.

Related Analysis

Practice All SC-300 Questions

Access 80 questions with complete answers and detailed explanations.

View Full SC-300 Practice Test →

← Back to SC-300 Study Guide