Examkin

Question

Difficulty: MediumUsers and Groups in Microsoft Entra ID

You are a Microsoft Azure administrator managing a Microsoft Entra ID tenant. You plan to configure a security group to assign Microsoft Entra roles directly to the group's members. Is the following statement true or false?

In Microsoft Entra ID, you can configure a security group with a dynamic user membership type if the group has the 'Roles can be assigned to the group' (isAssignableToRole) property set to Yes.

Answer: Answer

Answer

False
The statement is false. Microsoft Entra ID explicitly prevents security groups that are assignable to Microsoft Entra roles (isAssignableToRole set to Yes) from using dynamic membership rules. Role-assignable groups must use the 'Assigned' membership type to prevent security vulnerabilities like privilege escalation via user attribute modifications.

Step-by-Step Solution

1
Analyze the configuration requirement for a role-assignable security group.
Setting the 'Roles can be assigned to the group' (isAssignableToRole) property to Yes allows Microsoft Entra ID roles to be assigned directly to the group.
To identify the baseline capabilities and constraints of role-assignable groups.
2
Examine the membership type requirements for role-assignable groups.
Microsoft Entra ID enforces that any group with 'isAssignableToRole' set to Yes must use the 'Assigned' membership type.
To determine whether dynamic membership rules are compatible with role-assignable groups.
3
Compare this enforcement with the statement in the question.
The statement asserts that a dynamic membership group can also have roles assigned to it, which contradicts Entra ID's security restrictions.
To deduce the truth value of the statement.

Key Concept

Microsoft Entra ID restricts role-assignable groups to the 'Assigned' membership type, preventing the use of dynamic membership rules.
Rate this question

Topics

Users and Groups in Microsoft Entra ID

More questions from this topic