Examkin

Question

Difficulty: MediumUsers and Groups in Microsoft Entra ID

An administrator is configuring a dynamic user group in a Microsoft Entra ID tenant. The group must automatically include all internal employees assigned to the Sales department. The group must exclude guest users and must not include any device objects. Which dynamic membership rule should the administrator use?

  1. (user.department -eq 'Sales') -and (user.userType -eq 'Member')Answer
  2. B
    (user.department -eq 'Sales') -and (user.userRole -eq 'Member')
  3. C
    (user.department -eq 'Sales') -and (device.deviceOwnership -eq 'Company')
  4. D
    (user.department = 'Sales') and (user.userType = 'Member')

Answer

The dynamic membership rule containing '(user.department -eq 'Sales') -and (user.userType -eq 'Member')'
The rule using the format '(user.department -eq 'Sales') -and (user.userType -eq 'Member')' is correct because it uses valid Entra ID user attributes ('user.department' and 'user.userType'), correctly distinguishes internal employees ('Member') from guest users ('Guest'), and follows the required OData query syntax with hyphenated operators ('-eq' and '-and').

Step-by-Step Solution

1
Identify the target object type and the attributes required for the rule filter.
The group targets user objects. The required filters are the department (Sales) and the account type (internal employee, excluding guests).
Dynamic groups in Microsoft Entra ID must target either users or devices, and the filter conditions must map to valid object attributes.
2
Select the correct Entra ID user attributes for the filters.
The department is represented by 'user.department'. The internal vs. guest distinction is represented by 'user.userType', where 'Member' denotes internal employees and 'Guest' denotes external guests.
Using incorrect or non-existent attributes like 'userRole' will result in validation errors when saving the rule.
3
Apply the correct OData query syntax and structure.
Combine the attributes using the '-eq' and '-and' operators: '(user.department -eq 'Sales') -and (user.userType -eq 'Member')'.
Microsoft Entra ID dynamic group membership rules require OData v3.0 query syntax; using SQL-style operators or mixing user and device attributes is invalid.

Key Concept

Microsoft Entra ID dynamic group membership rules require valid OData properties and syntax, and cannot mix user and device objects.
Rate this question

Topics

Users and Groups in Microsoft Entra ID

More questions from this topic