Question

Difficulty: HardUsers and Groups in Microsoft Entra ID

Your company has a Microsoft Entra ID tenant that contains the following resources:

* User1: A cloud-only user account.
* User2: A user account synchronized from an on-premises Active Directory Domain Services (AD DS) domain.
* Group1: A security group with the `isAssignableToRole` property set to `true`.
* Group2: A dynamic security group with the membership rule: `(user.department -eq "Sales") -and (user.userType -eq "Member")`.
* AU1: An Administrative Unit. User1, User2, and Group1 are members of AU1.

The following administrative roles are assigned:

* Admin1: Assigned the User Administrator role scoped to AU1.
* Admin2: Assigned the Groups Administrator role scoped to AU1.

Which two statements are correct? Select two.

  1. User2 is automatically added to Group2 when User2's department attribute is synchronized to Microsoft Entra ID as 'Sales' and its UserType is 'Member'.Answer
  2. Admin1 can reset the password of User1, but cannot reset the password of User2.Answer
  3. C
    Admin2 can add User1 as a member of Group1.
  4. D
    Admin2 can change the membership type of Group1 to Dynamic User.

Answer

User2 is automatically added to Group2 when its department and UserType attributes are synchronized to Microsoft Entra ID, and Admin1 can reset the password of User1 but not User2.
The correct statements are that the synchronized user will be automatically added to the dynamic group once their synchronized attributes match the OData rule, and that the Administrative Unit-scoped User Administrator can reset the password of the cloud-only user but not the synchronized user. Dynamic groups evaluate all tenant users, including synchronized ones. Password administration for synchronized users cannot be performed by delegated cloud administrators since the source of authority is on-premises.

Step-by-Step Solution

1
Evaluate Group1 properties and the role required to modify it.
Group1 has isAssignableToRole set to true, making it a role-assignable group. Only Global Administrators, Privileged Role Administrators, or group owners can modify its membership or settings.
This determines if Admin2 can manage Group1's membership or membership type.
2
Evaluate the password reset permissions for Admin1.
Admin1 is a User Administrator scoped to AU1. User1 is a cloud-only user in AU1 and can be managed. User2 is a synchronized user whose password authority is managed on-premises, meaning Admin1 cannot reset User2's password in Entra ID.
This verifies whether Admin1 can reset passwords for the specified users.
3
Evaluate dynamic group evaluation for Group2.
Group2 is a tenant-wide dynamic group. Any user in the tenant, whether cloud-only or synchronized, will be added if they match the rule (department is 'Sales' and userType is 'Member').
This determines if User2 will be added to Group2.

Key Concept

Delegated administration using Administrative Units and security constraints on role-assignable groups.
Rate this question