Examkin

Question

Difficulty: MediumUsers and Groups in Microsoft Entra ID

An enterprise environment contains a Microsoft Entra ID tenant with a dynamic security group named Group1 and an administrative unit named AU1.

To manage access and delegate administration, you need to identify valid configuration options for these resources.

Which two actions can you successfully perform?

  1. Assign a Microsoft Entra ID administrative role at the AU1 scope to allow a user to manage the properties of other users within AU1.Answer
  2. Configure a dynamic membership rule for Group1 using the query syntax user.department -eq "Sales".Answer
  3. C
    Manually add specific cloud-only user accounts to Group1 to override the dynamic membership rule.
  4. D
    Assign an Azure RBAC role at the AU1 scope to grant a user permission to restart virtual machines in a resource group.
  5. E
    Configure a dynamic membership rule for Group1 using the query syntax user.department -eq "Sales" -and device.deviceOSVersion -eq "10.0".

Answer

The correct options are: assigning a Microsoft Entra ID administrative role at the administrative unit scope, and configuring a dynamic membership rule using the user department attribute query.
Assigning a Microsoft Entra ID administrative role at the administrative unit scope is correct because administrative units allow delegating administrative authority over specific subsets of users, groups, or devices. Configuring a dynamic membership rule using the user department query is correct because it defines a valid rule using standard attributes and syntax for a dynamic user group.

Step-by-Step Solution

1
Analyze dynamic group membership requirements.
Dynamic groups automate membership based on defined queries. They do not allow manual overrides, and a single rule cannot mix user and device attributes.
This rules out the options involving manual member addition and mixed-attribute queries.
2
Analyze administrative unit capabilities.
Administrative units are directory-level containers used to scope Entra ID roles (like User Administrator) but do not integrate with Azure RBAC roles for Azure resource access.
This rules out the option attempting to assign Azure RBAC roles at the administrative unit scope.
3
Verify correct OData query syntax and role assignment scopes.
The query user.department -eq "Sales" is syntactically correct, and assigning an Entra ID role at the administrative unit scope is a supported configuration.
This identifies the two correct configurations.

Key Concept

Microsoft Entra ID dynamic groups automate membership based on user or device attributes, while Administrative Units provide scoped access control for Entra ID directory roles, distinct from Azure RBAC resource scopes.
Rate this question

Topics

Users and Groups in Microsoft Entra ID

More questions from this topic