Your company has a Microsoft Entra ID tenant that contains the following resources:
* User1: A cloud-only user account.
* User2: A user account synchronized from an on-premises Active Directory Domain Services (AD DS) domain.
* Group1: A security group with the `isAssignableToRole` property set to `true`.
* Group2: A dynamic security group with the membership rule: `(user.department -eq "Sales") -and (user.userType -eq "Member")`.
* AU1: An Administrative Unit. User1, User2, and Group1 are members of AU1.
The following administrative roles are assigned:
* Admin1: Assigned the User Administrator role scoped to AU1.
* Admin2: Assigned the Groups Administrator role scoped to AU1.
Which two statements are correct? Select two.
- User2 is automatically added to Group2 when User2's department attribute is synchronized to Microsoft Entra ID as 'Sales' and its UserType is 'Member'.Answer
- Admin1 can reset the password of User1, but cannot reset the password of User2.Answer
- CAdmin2 can add User1 as a member of Group1.
- DAdmin2 can change the membership type of Group1 to Dynamic User.
Answer
User2 is automatically added to Group2 when its department and UserType attributes are synchronized to Microsoft Entra ID, and Admin1 can reset the password of User1 but not User2.
The correct statements are that the synchronized user will be automatically added to the dynamic group once their synchronized attributes match the OData rule, and that the Administrative Unit-scoped User Administrator can reset the password of the cloud-only user but not the synchronized user. Dynamic groups evaluate all tenant users, including synchronized ones. Password administration for synchronized users cannot be performed by delegated cloud administrators since the source of authority is on-premises.
Step-by-Step Solution
Key Concept
Delegated administration using Administrative Units and security constraints on role-assignable groups.