Assigning Owner Role to Microsoft Entra App Registrations
You have a Microsoft Entra tenant that contains the identities shown in the following table.
You register an app named App1 in the tenant.
To which identities can you assign the Owner role for App1?
Community Votes
66% of anonymous learners picked answer C. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
Tests the specific constraint that while Service Principals are valid owners, Security Groups are explicitly unsupported as app registration owners in Microsoft Graph.
Determines which identity types can be assigned as owners for an Azure AD application registration, specifically addressing the support status of users, groups, and service principals.
Selecting options that include Group1 or Group2 is a common error; candidates often assume groups function like users or service principals for ownership roles, but Microsoft documentation explicitly states group assignment is not supported.
Community Discussion (6 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
The correct answer is C (User1 and SP1) because Microsoft Entra ID allows both individual user accounts and service principals to be assigned as owners of an application registration. While User1 is a standard user identity eligible for this role, SP1 is a service principal associated with the tenant's infrastructure or other apps, which Microsoft Graph explicitly supports as a valid owner type. This capability allows for automated or programmatic management of app registrations without relying on a human user account.Why the Other Options Are Wrong
Options including Group1 or Group2 are incorrect because Microsoft has historically restricted the 'Owner' role on app registrations to individual users and service principals only; security groups cannot be added as owners via the portal or API. Even though Group1 and Group2 contain users who might be eligible individually, the group object itself is not a valid target for the Owner role on an app registration. Therefore, any option suggesting Group1 or Group2 as valid owners must be rejected.Community Comment Notes
Community feedback highlights a significant divergence between older exam dumps and current Microsoft behavior. Early comments suggested only users were supported, citing UI text from older versions or specific contexts where service principals were not visible. However, more recent verified comments confirm that while groups remain unsupported, service principals are indeed valid owners. As Provost noted, "Microsoft Graph is explicit on this — owners of an app registration can be individual users or service principals... Groups are never valid owners." Another commenter confirmed testing showed SPs can be assigned owners, validating Option C over the restrictive Option A.Exam Strategy
When managing app registrations, always check the latest Microsoft documentation regarding owner assignments. Remember that while you can assign multiple owners, the entity types are strictly limited to Users and Service Principals; Groups are a frequent distractor in these questions.
Frequently Asked Questions
Why can't I add a Group as an owner?
Microsoft Entra ID does not support assigning security groups as owners of app registrations. Only individual users and service principals are valid targets.
Is SP1 always a valid owner?
Yes, service principals can be assigned as owners of app registrations, allowing for non-human managed identities to administer applications.
Related Analysis
Practice All SC-300 Questions
Access 80 questions with complete answers and detailed explanations.
View Full SC-300 Practice Test →