Examkin

Question

Difficulty: Very hardUsers and Groups in Microsoft Entra ID

An organization has a Microsoft Entra ID tenant. The tenant contains an administrative unit named NorthAmerica-AU. The NorthAmerica-AU administrative unit contains a security group named NA-Sales-Dynamic. The membership type of NA-Sales-Dynamic is Dynamic User, configured with the following rule:

(user.department -eq "Sales") -and (user.country -eq "United States")

An administrator named Admin1 is assigned the Groups Administrator role scoped to the NorthAmerica-AU administrative unit. Admin1 is tasked with updating the membership rule of NA-Sales-Dynamic to also include sales users from Canada. When Admin1 attempts to update and save the dynamic rule, the operation fails with an authorization error.

Which of the following is the reason why Admin1 is unable to modify the membership rule of the group?

  1. Admin1 is assigned the Groups Administrator role at the administrative unit scope, but modifying dynamic group membership rules requires tenant-level administrator privileges.Answer
  2. B
    The dynamic membership rule query syntax is invalid because Microsoft Entra ID does not support nested logical operations.
  3. C
    Admin1 must be assigned the User Administrator role scoped to NorthAmerica-AU to manage dynamic groups containing user accounts.
  4. D
    Admin1 must be assigned the Owner role on the Azure subscription associated with the tenant to modify directory-level dynamic configurations.

Answer

Admin1 is assigned the Groups Administrator role at the administrative unit scope, but modifying dynamic group membership rules requires tenant-level administrator privileges.
Modifying dynamic group membership rules requires tenant-level administrative privileges (such as a tenant-scoped Groups Administrator or Global Administrator) because the rule evaluation engine runs tenant-wide and can affect users outside the administrative unit. A role scoped to an administrative unit does not grant permissions to edit dynamic rules.

Step-by-Step Solution

1
Analyze the current role assignment of the administrator.
Admin1 holds the Groups Administrator role scoped specifically to the NorthAmerica-AU administrative unit.
This establishes the scope boundary of the administrator's permissions.
2
Identify the operation being performed.
Admin1 is trying to update a dynamic membership rule for a dynamic user security group.
Dynamic groups evaluate their queries across all objects in the tenant to determine membership.
3
Compare the operation requirements with the scope of the administrative unit role.
Because dynamic group rules evaluate tenant-wide, modifying their configuration is restricted to tenant-level roles (such as tenant-scoped Groups Administrator or Global Administrator).
An administrative unit-scoped role assignment is insufficient to perform changes that have tenant-wide evaluation scope.

Key Concept

Microsoft Entra ID role scoping and dynamic group management constraints
Rate this question

Topics

Users and Groups in Microsoft Entra ID

More questions from this topic