Examkin

Question

Difficulty: HardUsers and Groups in Microsoft Entra ID

Your company has a Microsoft Entra ID tenant. The tenant contains an Administrative Unit named Sales-AU and a dynamic security group named Sales-Dynamic-Group. Sales-Dynamic-Group is a member of Sales-AU.

You assign a user named Admin1 the Groups Administrator role scoped to Sales-AU.

Admin1 attempts to perform the following tasks:
1. Modify the membership of an assigned security group named Sales-Manual-Group that is a member of Sales-AU.
2. Modify the dynamic membership rule of Sales-Dynamic-Group.

Which tasks can Admin1 successfully perform?

  1. Only task 1Answer
  2. B
    Only task 2
  3. C
    Both task 1 and task 2
  4. D
    Neither task 1 nor task 2

Answer

Only task 1
The correct answer is the option stating that only task 1 can be performed. An administrator with the Groups Administrator role scoped to an Administrative Unit (AU) can manage the membership of standard assigned groups that are members of that AU. However, they cannot modify dynamic group rules. Modifying dynamic group rules requires directory-level (tenant-wide) Groups Administrator or Global Administrator privileges because dynamic rules are evaluated tenant-wide, and permitting an AU-scoped administrator to modify them would allow them to bypass the administrative boundary.

Step-by-Step Solution

1
Analyze the administrative role and scope assigned to the user.
Admin1 is assigned the Groups Administrator role scoped to the Sales-AU Administrative Unit.
This defines the security boundary and permissions of Admin1.
2
Evaluate the permissions required to modify the membership of the assigned security group.
Sales-Manual-Group is an assigned security group in Sales-AU. An Administrative Unit-scoped Groups Administrator is authorized to manage memberships of assigned groups within their unit.
Managing assigned groups within the scoped Administrative Unit is a core capability of the scoped Groups Administrator role.
3
Evaluate the permissions required to modify the dynamic group membership rules.
Sales-Dynamic-Group is a dynamic group. Modifying dynamic rules can potentially add any user in the entire tenant to the group if the rule query is adjusted. To prevent privilege escalation, dynamic group rule modifications are restricted to directory-level administrators.
Administrative Unit scoped roles do not permit editing dynamic group membership rules, even if the dynamic group is a member of the Administrative Unit.

Key Concept

Administrative Unit scope limits for group management and dynamic group rule modification constraints in Microsoft Entra ID
Rate this question

Topics

Users and Groups in Microsoft Entra ID

More questions from this topic