MS-102 Practice Question: Implement and manage Microsoft Entra identity and access
Your company uses Microsoft Entra ID and has an app named App1 that requires permissions to read all user profiles. You need to grant admin consent for App1 to read profiles without requiring each user to consent. What should you do?
⚠ Common exam trap
Test-takers frequently confuse 'granting admin consent' with 'configuring user consent settings' or 'creating a new app registration', not realizing that admin consent is a specific action on the existing enterprise application's permissions blade.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
From Microsoft Entra ID, go to Enterprise applications, select App1, and grant admin consent.
Granting admin consent for an enterprise application in Microsoft Entra ID allows a tenant administrator to pre-approve permissions for all users, eliminating the need for individual user consent. This is done by navigating to Enterprise applications, selecting App1, and using the 'Grant admin consent' option, which sends an OAuth 2.0 authorization request with the required permissions (e.g., User.Read.All) on behalf of the entire organization.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Create a Conditional Access policy that requires consent for App1.
Why it's wrong here
Conditional Access policies are signal-based access controls that enforce requirements such as MFA, device compliance, or sign-in risk at authentication time; they do not act on application permissions or OAuth consent grants. There is no 'require consent' condition or control in Conditional Access, and applying a policy cannot approve permissions on behalf of an organization. Consenting to App1's permissions must be done through the application's Permissions page or via Microsoft Graph, not through a Conditional Access policy.
- ✗
Register a new application in App registrations and assign the required permissions.
Why it's wrong here
Registering a new application in App registrations creates a separate principal with its own client ID and configured API permissions; it does not modify the existing App1 enterprise application or its service principal. The admin consent status and required permissions for App1 are tied to App1's own service principal in Enterprise applications, so creating another app leaves App1 without the necessary consent. To resolve the issue for App1, you must grant admin consent on its existing enterprise application.
- ✓
From Microsoft Entra ID, go to Enterprise applications, select App1, and grant admin consent.
Why this is correct
To grant admin consent for App1, navigate to Microsoft Entra ID > Enterprise applications, select App1, then choose Permissions and click the Grant admin consent button. This action applies the app's required permissions to the tenant on behalf of all users, eliminating the need for individual user consent. This is the direct, supported method in the administration center for an existing enterprise application.
- ✗
Configure the user consent settings to allow users to consent for themselves.
Why it's wrong here
Configuring user consent settings only controls whether end users are allowed to grant consent to applications when signing in; it does not approve permissions for a specific app such as App1. If App1 requires admin consent, likely because its permissions are high-risk or require tenant-wide access, an administrator must explicitly grant that consent. This setting is also forward-looking and does not retroactively provide admin consent for an already registered application.
Go deeper
Related to this question
Learn chapter
Entra ID Entitlement Management and Access Packages
Key term
Microsoft Entra ID
Microsoft Entra ID is a cloud-based identity and access management service that lets employees sign in and access resources both inside and outside of your organization.
Key term
Access token
A digital key that a computer system gives you to prove your identity and grant you permission to access specific resources or perform actions.
About these practice questions
Courseiva writes every MS-102 question from scratch — 712 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MS-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MS-102 exam.