Examkin

Question

Difficulty: MediumUsers and Groups in Microsoft Entra ID

An administrator needs to configure a new Microsoft Entra ID group to automatically manage access. The group must dynamically include all users belonging to the Marketing department who are also using corporate-owned Windows 11 devices. Which of the following statements correctly describes a configuration requirement or limitation for this group?

  1. A
    The dynamic membership rule query must use syntax that combines both attributes, such as (user.department -eq 'Marketing') and (device.deviceOSVersion -startsWith '10.0').
  2. B
    To configure and save the dynamic rule, the administrator must be assigned the User Access Administrator Azure RBAC role at the resource group scope.
  3. You must create two separate dynamic groups—one for users and one for devices—because a single dynamic group cannot evaluate both user and device attributes.Answer
  4. D
    You must first place both the users and the devices in the same Administrative Unit to allow cross-attribute evaluation of users and devices.

Answer

You must create two separate dynamic groups—one for users and one for devices—because a single dynamic group cannot evaluate both user and device attributes.
The correct option states that you must create two separate dynamic groups. In Microsoft Entra ID, dynamic groups are strictly typed as either Dynamic User or Dynamic Device. The membership rule engine does not support referencing both user and device attributes in the same query. To achieve the goal, separate groups for users and devices must be created.

Step-by-Step Solution

1
Analyze the requirements for the group membership.
The requirement is to dynamically group users based on their department (a user attribute) and their device operating system (a device attribute).
Identifying the target attributes allows the administrator to determine if they belong to the same object type.
2
Evaluate Microsoft Entra ID dynamic group capabilities and constraints.
Microsoft Entra ID dynamic group membership rules only support querying properties of a single object type (either users or devices) per group.
This determines whether a single query can fulfill the requirement or if separate groups are necessary.
3
Select the correct administrative approach based on the constraint.
Create separate dynamic groups for users and devices, or use alternative mechanisms like conditional access or endpoint management to enforce policies.
Since a single dynamic group cannot mix user and device attributes, separating them is the required workaround.

Key Concept

Microsoft Entra ID dynamic group membership rules must evaluate either user attributes or device attributes, but not both in a single query.
Estimated Time:1m 30s
Rate this question

Topics

Users and Groups in Microsoft Entra ID

More questions from this topic