Examkin

Question

Difficulty: Very hardAdministrative Units and License Management

Your company has a Microsoft Entra ID tenant containing a user named Admin1 and a user named User1. You configure the following:

1. An administrative unit named HQ-AU with a dynamic membership rule: `user.department -eq "Finance"`.
2. A security group named Finance-Group with assigned (static) membership. You add User1 as a member of Finance-Group.
3. You add Finance-Group to HQ-AU. User1 is not manually added to HQ-AU.
4. You assign Admin1 the User Administrator role scoped to HQ-AU.
5. You assign a Microsoft 365 E5 license to Finance-Group.

User1's department attribute is currently set to "Finance". You update User1's department attribute to "Sales". Immediately after updating the attribute, Admin1 attempts to reset the password of User1.

What is the result of Admin1's password reset attempt?

  1. The password reset will succeed immediately because dynamic membership changes are processed asynchronously, but a subsequent attempt after the membership is updated will fail due to the non-transitive nature of administrative unit scopes.Answer
  2. B
    The password reset will fail immediately because Entra ID evaluates dynamic membership rules in real-time, instantly removing the user from the scope of the administrative unit.
  3. C
    The password reset will succeed immediately and will continue to succeed indefinitely because the user remains within the scope of the administrative unit by virtue of their membership in the security group.
  4. D
    The password reset will fail immediately because the administrator requires an Azure subscription RBAC role, such as Owner or User Access Administrator, to manage users who have group-assigned licenses.

Answer

The password reset will succeed immediately because dynamic membership changes are processed asynchronously, but a subsequent attempt after the membership is updated will fail due to the non-transitive nature of administrative unit scopes.
The correct answer is correct because Microsoft Entra ID evaluates dynamic membership rules asynchronously. Immediately after the department attribute update, the rule has not yet processed, leaving the user within the administrative unit (AU). Consequently, the scoped administrator retains management permissions. Once the system processes the change and removes the user from the AU, subsequent management attempts will fail because AU scope is non-transitive; having a group inside an AU does not extend the administrator's authority to the members of that group.

Step-by-Step Solution

1
Determine the initial membership of User1 in the administrative unit (HQ-AU).
Since User1's department is 'Finance', the dynamic rule 'user.department -eq "Finance"' evaluates to true, making User1 a direct member of HQ-AU.
To evaluate the administrator's permission scope, we must first establish if the target user is a member of the administrative unit.
2
Analyze the impact of updating User1's department to 'Sales' on the dynamic rule processing time.
Microsoft Entra ID dynamic rules are processed asynchronously. Immediately after the update, the rule has not yet re-evaluated, so User1 remains a member of HQ-AU.
Dynamic membership changes do not occur in real-time, resulting in a temporary window where old membership persists.
3
Evaluate the result of the immediate password reset attempt by Admin1.
The attempt succeeds because Admin1 is a User Administrator scoped to HQ-AU, and User1 is still dynamically a member of HQ-AU.
Scoped role permissions apply to all current members of the administrative unit.
4
Analyze the long-term permission state after the dynamic rule processes and removes User1 from HQ-AU.
User1 is removed from HQ-AU. Although User1 is a member of Finance-Group (which is in HQ-AU), AU scopes are non-transitive, meaning Admin1 cannot manage members of Finance-Group.
Administrative unit delegation does not transitively extend permissions to members of groups contained within the unit.

Key Concept

Administrative Unit scoping and dynamic membership processing behavior
Estimated Time:3m 0s
Rate this question

Topics

Administrative Units and License Management

More questions from this topic