Reference:
In Azure AD, when an enterprise application's property "User assignment required" is set to Yes, only users or groups explicitly assigned to that application can sign in or even see it in the My Apps portal. This rule ensures that access to the application is restricted to designated users and groups.
The Microsoft SC-300 Study Guide and Microsoft Learn module "Assign users and groups to an enterprise app" explain that if users are unable to see an enterprise app in their My Apps portal, it is often because they have not been assigned to it while User assignment required = Yes.
Given that:
User assignment required = Yes
The group HRUsers has access to App1 and App2 (but not App3)
The same group should be able to see all three apps
The logical resolution is to assign HRUsers to App3 under Users and groups.
Other options are incorrect because:
B). Change User assignment required to No would make the app visible to all users - violating the requirement that access is restricted.
C). Review User consent permissions only affects delegated API permissions, not visibility.
D). Configure sign-on method affects authentication, not app visibility.
Hence, to ensure the users can view and access App3, you must assign the HRUsers group to the application in its Users and groups blade.
# Correct Answer: A. From Users and groups, add HRUsers