Examkin

Question

Difficulty: Very hardUsers and Groups in Microsoft Entra ID

You manage a Microsoft Entra ID tenant. The tenant contains an administrative unit named HQ-AU and a user named Admin1. Admin1 is assigned the User Administrator role scoped to HQ-AU.

The tenant contains the following two groups:
* Group1: A security group that has the isAssignableToRole property set to Yes and the membership type set to Assigned. Group1 is in the scope of HQ-AU.
* Group2: A security group that has the isAssignableToRole property set to No and the membership type set to Dynamic User. Group2 is in the scope of HQ-AU.

You need to ensure that Admin1 can perform the following tasks:
* Add and remove members in Group1.
* Modify the dynamic membership rule of Group2.

Which two actions should you perform? Each correct answer presents a part of the solution.

  1. Add Admin1 as an owner of Group1.Answer
  2. Assign the Groups Administrator role to Admin1 at the tenant level.Answer
  3. C
    Assign the User Administrator role to Admin1 at the subscription level.
  4. D
    Change the membership type of Group1 to Dynamic User.
  5. E
    Assign the Directory Readers role to Admin1 at the tenant level.

Answer

Add Admin1 as an owner of Group1, and assign the Groups Administrator role to Admin1 at the tenant level.
Adding the user as an owner of Group1 allows managing its membership despite it being role-assignable. Assigning the Groups Administrator role at the tenant level provides the necessary permissions to edit dynamic membership rules across the tenant, which cannot be done with administrative unit scopes.

Step-by-Step Solution

1
Analyze permissions for role-assignable groups.
Determine that only Global Administrators, Privileged Role Administrators, or group owners can manage memberships of groups where isAssignableToRole is set to Yes.
To identify how to delegate membership management of Group1 to Admin1.
2
Analyze permissions for dynamic membership rules.
Determine that modifying dynamic membership rules requires tenant-level administrator roles (such as Groups Administrator or User Administrator) and cannot be done with administrative unit scope.
To identify how to delegate dynamic rule modification of Group2 to Admin1.
3
Select configuration actions that meet requirements using the least privilege principle.
Add Admin1 as an owner of Group1 (satisfies task 1) and assign the Groups Administrator role at the tenant level (satisfies task 2).
To correctly select the minimal configuration changes required.

Key Concept

Delegating Microsoft Entra ID group management under role-assignable and dynamic membership constraints.
Rate this question

Topics

Users and Groups in Microsoft Entra ID

More questions from this topic