See the Explanation for the complete step by step solution.
Explanation:
To implement additional security checks for the Sg-Executive group members before they can access any company apps, you can use Conditional Access policies in Microsoft Entra. Here's a step-by-step guide:
* Sign in to the Microsoft Entra admin center:
* Ensure you have the role of Global Administrator or Security Administrator.
* Navigate to Conditional Access:
* Go to Security > Conditional Access.
* Create a new policy:
* Select + New policy.
* Name the policy appropriately, such as "Sg-Executive Security Checks".
* Assign the policy to the Sg-Executive group:
* Under Assignments, select Users and groups.
* Choose Select users and groups and then Groups.
* Search for and select the Sg-Executive group.
* Define the application control conditions:
* Under Cloud apps or actions, select All cloud apps to apply the policy to any company app.
* Set the device compliance requirement:
* Under Conditions > Device state, configure the policy to include devices marked as compliant by Microsoft Intune.
* Set the app protection policy requirement:
* Under Conditions > Client apps, configure the policy to include client apps that are protected by app protection policies.
* Configure the access controls:
* Under Access controls > Grant, select Grant access.
* Choose Require device to be marked as compliant and Require approved client app.
* Ensure that the option Require one of the selected controls is enabled.
* Enable the policy:
* Set Enable policy to On.
* Review and save the policy:
* Review all settings to ensure they meet the requirements.
* Click Create to save and implement the policy.
By following these steps, you will ensure that the Sg-Executive group members can only access company apps if they meet one of the specified conditions, either by using a compliant device or a protected client app.
This enhances the security posture of your organization by enforcing stricter access controls for executive- level users.

According to the Microsoft SC-300 official study guide and Microsoft documentation on Azure AD Privileged Identity Management (PIM), PIM is used to manage, control, and monitor access within Azure Active Directory (Azure AD), Azure resources, and Microsoft 365. However, not every administrative role within Azure or Microsoft 365 can be managed or activated through PIM.
To understand which administrators can use PIM, we need to review how Azure roles are structured:
* Account Administrator - This role is a classic subscription administrator role, not part of Azure AD role-based access control (RBAC). Therefore, it is not managed or activated through PIM.
* Service Administrator - Also a classic Azure subscription role, but it maps to the Owner role in Azure RBAC. PIM can manage and activate this role because it exists within the RBAC model, which PIM supports.
* SharePoint Administrator - This is an Azure AD directory role, not a classic subscription role, and is supported in Azure AD PIM. Azure AD PIM supports activation for directory roles such as Global Administrator, SharePoint Administrator, Exchange Administrator, etc.
From Microsoft's official documentation:
"Azure AD Privileged Identity Management can manage role assignments for both Azure AD directory roles and Azure resource roles (via Azure RBAC). Classic subscription administrator roles such as Account Administrator are not supported." Therefore, Admin1 (Account Administrator) cannot use PIM because their role is outside the scope of PIM.
Admin2 (Service Administrator) and Admin3 (SharePoint Administrator) can both use PIM since their roles are recognized by PIM as eligible for activation.

Explanation:

Reference:
https://docs.microsoft.com/en-us/azure/active-directory/roles/delegate-app-roles

Explanation:
User1 must request access to App1 before they can use the app: No
If User2 requests access to App1, they will be added to Gro up1 automatically: Yes User2 can approve App1 requests by using the Microsoft Entra admin center: Yes Let's break this down step by step based on Microsoft Entra ID self-service application access and the configured settings, as outlined in Microsoft Iden tity and Access Administrator documentation.
Understanding Self-Service Application Access in Microsoft Entra ID:
Self-service application access in Microsoft Entra ID allows users to request access to applications without needing an administrator to manua lly assign them. This is configured on a per-application basis.
The settings for App1 are:
Allow users to request access to this application: Yes- Users can request access to App1.
To which group should assigned users be added: Group1- Users who are grante d access will be added to Group1, which provides the necessary permissions to use App1.
Require approval before granting access to this application: Yes- Access requests must be approved before the user is added to Group1.
Who is allowed to approve access to this application: User2- User2 is the designated approver for access requests to App1.
Statement 1: User1 must request access to App1 before they can use the app.
Analysis:
User1 is already a member of Group1, as stated in the question.
The self-service settings specify that users who are granted access to App1 will be added to Group1. This implies that membership in Group1 is what grants access to App1.
Since User1 is already a member of Group1, they already have access to App1. In Microsoft Entra ID, i f a user is already assigned to an application (either directly or via group membership), they do not need to request access through the self-service process-they can simply use the app.
The self-service access request process is for users who are not yet assigned to the app (i.e., not in Group1).
Since User1 is already in Group1, they do not need to request access.
Conclusion:This statement isNo. User1 does not need to request access because they are already a member of Group1 and can use App1 immediately.
Statement 2: If User2 requests access to App1, they will be added to Group1 automatically.
Analysis:
User2 is not a member of Group1 (the question does not state that User2 is in Group1).
The self-service settings allow users to request access to App1, an d the setting " To which group should assigned users be added: Group1 " means that users who are granted access will be added to Group1.
However, the setting " Require approval before granting access to this application: Yes " means that User2's request must be approved before they are added to Group1. The approver for App1 requests is User2 themselves, which introduces a potential conflict.
In Microsoft Entra ID, if a user is both the requester and the approver, the system typicallyallows them to approve thei r own request (unless additional policies prevent this, which is not specified in the question).
Therefore, User2 can request access and approve their own request.
Once the request is approved, User2 will be added to Group1 automatically as per the self-se rvice settings.
The term " automatically " in the statement refers to the process after approval-once approved, the addition to Group1 happens without further manual intervention.
Conclusion:This statement isYes. If User2 requests access to App1 and approves their own request, they will be added to Group1 automatically.
Statement 3: User2 can approve App1 requests by using the Microsoft Entra admin center.
Analysis:
The self-service settings specify that User2 is the designated approver for access requests to App1.
In Microsoft Entra ID, approvers can manage access requests through the Microsoft Entra admin center (via the " My Access " portal or the " Access Requests " section, depending on their role and permissions).
User2, as the designated approver, will rece ive a notification (via email or the My Access portal) when a request is made. They can then log into the Microsoft Entra admin center, navigate to the access requests section, and approve or deny the request.
Even though User2 is not explicitly an admin, the fact that they are designated as the approver for App1 requests grants them the ability to approve requests through the Microsoft Entra admin center.
Conclusion:This statement isYes. User2 can approve App1 requests using the Microsoft Entra admin cente r.
Additional Considerations:
If User2 were not allowed to approve their own request (e.g., due to a separation of duties policy), Statement
2 might be affected. However, Microsoft Entra ID does not enforce such a restriction by default, and the question d oes not specify any additional policies.
The Microsoft Entra admin center is the primary interface for managing access requests, but users can also approve requests via email links or the My Access portal. The statement specifically mentions the admin cent er, which is a valid method.
Conclusion:
Statement 1:No- User1 does not need to request access since they are already in Group1.
Statement 2:Yes- User2 will be added to Group1 automatically after their request is approved (by themselves).
Statement 3:Yes- User2 can approve requests using the Microsoft Entra admin center.
References:
Microsoft Entra ID documentation: " Configure self-service application access " (Microsoft Learn:
https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/configure-self-se rvice) Microsoft Entra ID documentation: " Manage access requests " (Microsoft Learn:https://learn.microsoft.com
/en-us/entra/identity/governance/access-reviews-overview)
Microsoft Identity and Access Administrator (SC-300) exam study guide, which covers self -service application access and approval workflows in Microsoft Entra ID.