Examkin

Question

Difficulty: MediumUsers and Groups in Microsoft Entra ID

An administrator needs to create a new security group named IT-Admins in a Microsoft Entra ID tenant. The group will be assigned the Helpdesk Administrator role. Which of the following configurations must the administrator select during the group creation process? (Select TWO.)

  1. Set 'Membership type' to AssignedAnswer
  2. Set 'Microsoft Entra roles can be assigned to the group' to YesAnswer
  3. C
    Set 'Membership type' to Dynamic User and define a query for the IT department
  4. D
    Assign the Helpdesk Administrator role to the group using an Azure RBAC subscription-level assignment

Answer

Setting the 'Membership type' to 'Assigned' and setting 'Microsoft Entra roles can be assigned to the group' to 'Yes' are both required configurations.
To assign Microsoft Entra roles directly to a security group, the group must be configured as a role-assignable group. This requires setting the 'Microsoft Entra roles can be assigned to the group' option to 'Yes' during the group creation process, which in turn forces the 'Membership type' to 'Assigned' because dynamic groups cannot be assigned to Microsoft Entra roles.

Step-by-Step Solution

1
Determine the type of role to be assigned.
The Helpdesk Administrator role is a Microsoft Entra ID role.
Microsoft Entra ID roles require specific group configurations for direct assignment, unlike Azure RBAC roles.
2
Evaluate the membership type constraint for role-assignable groups.
Dynamic membership types (Dynamic User or Dynamic Device) are not allowed for role-assignable groups.
Microsoft Entra ID requires role-assignable groups to have their membership type set to 'Assigned'.
3
Identify the creation-time configuration required for role assignment.
The option 'Microsoft Entra roles can be assigned to the group' must be set to 'Yes' during creation.
This switch is only available during the creation phase of the group and cannot be enabled later.

Key Concept

Microsoft Entra ID Role-Assignable Groups
Rate this question

Topics

Users and Groups in Microsoft Entra ID

More questions from this topic