Examkin

Question

Difficulty: Very hardUsers and Groups in Microsoft Entra ID

Your company has a Microsoft Entra ID tenant. The tenant contains an Administrative Unit named Corporate-AU. The following resources are members of Corporate-AU:

* A user named User1
* A dynamic user group named HQ-Staff

A user named Admin1 is currently assigned the Groups Administrator role scoped to Corporate-AU. You need to ensure that User1 is added to HQ-Staff. The solution must follow the principle of least privilege. Which action should you perform?

  1. Assign the User Administrator role scoped to Corporate-AU to Admin1, and then modify the attributes of User1 to match the dynamic membership rule.Answer
  2. B
    Assign the User Administrator role scoped to Corporate-AU to Admin1, and then manually add User1 to HQ-Staff.
  3. C
    Assign the Groups Administrator role at the tenant scope to Admin1, and then modify the membership rule of HQ-Staff to include User1.
  4. D
    Assign the Contributor role at the subscription scope to Admin1, and then modify the properties of User1.

Answer

Assign the User Administrator role scoped to Corporate-AU to Admin1, and then modify the attributes of User1 to match the dynamic membership rule.
The correct answer is to assign the User Administrator role scoped to Corporate-AU to Admin1 and modify the attributes of User1. Because HQ-Staff is a dynamic group, membership is calculated automatically by Microsoft Entra ID based on the user's attributes matching the group's dynamic membership rule. To trigger membership, User1's attributes must be modified. Since User1 is in Corporate-AU, assigning the User Administrator role scoped to Corporate-AU to Admin1 provides the exact permissions required to modify User1's attributes without granting unnecessary directory-wide permissions, following the principle of least privilege.

Step-by-Step Solution

1
Analyze the group type of HQ-Staff.
HQ-Staff is a dynamic user group.
You cannot manually add or remove members in a dynamic group; membership is managed by the system based on rules.
2
Identify the minimum administrative change required to add User1 to the dynamic group.
Modify User1's attributes to match the dynamic membership rule of HQ-Staff.
This is the only valid way to add a user to a dynamic group.
3
Determine the administrative role needed to modify User1's attributes within the scope of Corporate-AU.
User Administrator role scoped to Corporate-AU.
Since User1 is a member of Corporate-AU, an administrator with the User Administrator role scoped to Corporate-AU can modify User1's attributes without requiring tenant-wide permissions, satisfying the least privilege requirement.

Key Concept

Microsoft Entra ID dynamic group membership management and administrative unit role delegation.
Rate this question

Topics

Users and Groups in Microsoft Entra ID

More questions from this topic