Examkin

Question

Difficulty: MediumUsers and Groups in Microsoft Entra ID

An administrator manages a Microsoft Entra ID tenant. A user named User1 is configured as the owner of an assigned security group named Group1. User1 is not assigned any Microsoft Entra ID directory roles.

Statement: User1 can delete Group1 from the Microsoft Entra admin center.

Is this statement true or false?

Answer: Answer

Answer

The statement is false. Group owners cannot delete the group they own unless they are assigned a directory role with group deletion permissions, such as Groups Administrator or Global Administrator.
The statement is false because group owners are only authorized to manage members and other owners. They cannot delete the group itself. Deleting a security group requires directory roles such as Groups Administrator, User Administrator, or Global Administrator.

Step-by-Step Solution

1
Analyze the permissions of a group owner in Microsoft Entra ID.
A group owner can add or remove members, add or remove other owners, and edit group settings (like description or name, depending on tenant settings), but cannot delete the group.
Group ownership is a delegated administrative feature designed for membership management, not full lifecycle control of the resource object.
2
Determine the role required to delete a group in Microsoft Entra ID.
Deleting a group requires directory-level administrative privileges, which are granted via roles like Groups Administrator, User Administrator, or Global Administrator.
Deleting a directory object is a high-privilege action that affects the entire tenant's directory structure.
3
Evaluate the statement against the analyzed permissions.
Since User1 is only a group owner and has no directory roles, User1 cannot delete Group1.
User1 lacks the required directory role permissions to delete a group object.

Key Concept

Delegated group management vs directory roles in Microsoft Entra ID
Rate this question

Topics

Users and Groups in Microsoft Entra ID

More questions from this topic