Examkin

Question

Difficulty: HardUsers and Groups in Microsoft Entra ID

An organization's Microsoft Entra ID tenant contains an administrative unit named Branch-AU. A user named Admin1 is assigned the Groups Administrator role, with the scope of the assignment restricted to Branch-AU. Within Branch-AU, there is a security group named Branch-Support that currently has a membership type of Assigned. Admin1 attempts to convert Branch-Support to a dynamic group and configure a dynamic membership rule based on user attributes. However, Admin1 is unable to change the group's membership type. You need to identify the cause of this issue. What is the cause of the issue?

  1. A
    Admin1 is not defined as an Owner of the Branch-Support group, and only group owners can change a group's membership type.
  2. Admin1's Groups Administrator role is scoped to the administrative unit, which does not permit the creation or management of dynamic groups.Answer
  3. C
    Admin1 requires the User Administrator role scoped to Branch-AU, as the Groups Administrator role cannot modify the properties of existing groups.
  4. D
    Admin1 must be assigned the User Access Administrator Azure role at the subscription level to manage directory group settings.

Answer

Admin1's Groups Administrator role is scoped to the administrative unit, which does not permit the creation or management of dynamic groups.
The correct answer is correct because Microsoft Entra ID restricts the management of dynamic groups to tenant-level administrative roles. Since Admin1's Groups Administrator role is scoped to the Branch-AU administrative unit, Admin1 cannot modify the membership type or edit rules for dynamic groups. A tenant-level role assignment is required because dynamic group queries can evaluate user attributes across the entire tenant, which exceeds the boundaries of an administrative unit.

Step-by-Step Solution

1
Identify the administrator's role and delegation scope in Microsoft Entra ID.
Admin1 is assigned the Groups Administrator role scoped specifically to the Branch-AU administrative unit.
Determining the role and scope helps evaluate the permissions and limits of the administrative assignment.
2
Analyze the requirements for managing dynamic groups and changing membership types.
Converting a group to dynamic or editing dynamic membership rules requires tenant-level administrator privileges.
Dynamic groups evaluate user or device attributes across the entire tenant, making it a directory-wide operation rather than one restricted to a specific scope.
3
Evaluate the administrative unit (AU) scoped role limitations.
Roles scoped to an administrative unit do not permit the management or creation of dynamic groups.
This restriction explains why Admin1 cannot perform the group conversion action.

Key Concept

Microsoft Entra ID administrative unit role scope limitations and dynamic group management requirements
Rate this question

Topics

Users and Groups in Microsoft Entra ID

More questions from this topic