Question

Difficulty: MediumUsers and Groups in Microsoft Entra ID

You manage a Microsoft Entra ID tenant. You have the following users configured in the tenant:

UserDepartmentUserType
User1SalesMember
User2salesMember
User3MarketingMember
User4SalesGuest

You create a dynamic user group named SalesGroup and configure the dynamic membership rule for SalesGroup as follows:

`(user.department -eq "Sales") -and (user.userType -ne "Guest")`

Which users are members of SalesGroup?

  1. A
    User1 only
  2. User1 and User2 onlyAnswer
  3. C
    User1, User2, and User4 only
  4. D
    User1, User2, User3, and User4

Answer

User1 and User2 only
The correct answer is the option stating 'User1 and User2 only'. In Microsoft Entra ID, dynamic membership rules evaluate string attributes without case sensitivity, so 'Sales' matches both 'Sales' and 'sales'. Since both User1 and User2 are members, and User4 is a guest, they are the only users matching both conditions of the rule.

Step-by-Step Solution

1
Evaluate the department condition: `user.department -eq "Sales"`.
User1, User2, and User4 match.
Microsoft Entra ID dynamic group membership rules perform case-insensitive string comparisons. Therefore, both 'Sales' and 'sales' satisfy this condition, while 'Marketing' does not.
2
Evaluate the user type condition: `user.userType -ne "Guest"`.
User1 and User2 match.
The `-ne` operator means 'not equal'. User1 and User2 have a UserType of 'Member', which satisfies this condition. User4 has a UserType of 'Guest', so they are excluded.
3
Combine the results of both conditions using the logical `-and` operator.
Only User1 and User2 satisfy both conditions.
The logical `-and` operator requires both parts of the rule to evaluate to true for a user to be included.

Key Concept

Microsoft Entra ID dynamic group membership rules use case-insensitive string comparisons and logical operators to determine group membership.
Estimated Time:1m 30s
Rate this question