You have a Microsoft 365 tenant that contains a group named Group1 as shown in...

No

No

Yes

a) When you assign a group to an application, only users in the group will have access. The assignment does not cascade to nested groups.

b) Tested in lab, existing owners will be replaced. Also direct assignment (resource owner) is path of least privilege. (replicated in test)

c) Application setting ' visible to users ' is set to No, then no users see this application on their My Apps portal and O365 launcher.

Reference

According to the Microsoft SC-300: Identity and Access Administrator Study Guide, Azure AD Enterprise Application Self-service configuration determines how users can request access, who approves it, and whether access is automatically granted. Let’s analyze each statement based on the exhibits:

Members of Group3 can access App1 without approval from User1 — NO In the Group1 exhibit, Group1 contains User1, User4, and Group3 . In the App1 Self-Service exhibit, it shows that “Require approval before granting access” is set to Yes, and User1 is designated as the approver. Therefore, even though Group3 members might indirectly be part of Group1, access requests to App1 must still be approved by User1 before being granted.

After configuring self-service, the owner of Group1 is User1 — NO The PowerShell command Get-AzureADGroupOwner clearly shows that Admin (not User1) is the owner of Group1. Configuring self-service for an application does not change group ownership; it only defines how access requests are handled. Ownership of Group1 remains with Admin.

App1 appears in the Microsoft 365 app launcher of User4 — YES In the App1 Properties exhibit, the “User assignment required” setting is set to Yes. This means only assigned users (directly or via groups) can see and access the application. Since Group1 is configured as the target group for user assignment and User4 is a member of Group1, User4 will see App1 in their Office 365 app launcher after assignment approval.

This logic follows Microsoft Learn documentation:

“When a user is assigned to an enterprise application (either directly or through group membership), the application appears in the user ' s Office 365 app launcher once access is granted.”