Examkin

Question

Difficulty: MediumUsers and Groups in Microsoft Entra ID

You manage a Microsoft Entra ID tenant. You configure a security group named Dev-Staff that uses a dynamic user membership rule. You need to delegate the ability to modify the dynamic membership rule of Dev-Staff to a user named Admin1. The solution must follow the principle of least privilege. Which role should you assign to Admin1?

  1. Groups Administrator role in Microsoft Entra IDAnswer
  2. B
    Owner of the Dev-Staff group
  3. C
    User Access Administrator role at the Azure subscription level
  4. D
    User Administrator role scoped to an Administrative Unit containing Dev-Staff

Answer

Groups Administrator role in Microsoft Entra ID
The Groups Administrator role is the least privileged Microsoft Entra ID built-in role that allows users to create, update, and manage all aspects of dynamic groups, including their membership query rules.

Step-by-Step Solution

1
Determine the administrative requirements for modifying dynamic group rules.
Identify that editing dynamic membership rules requires directory-level group management privileges because the rules evaluate all users across the entire tenant.
To select the appropriate role, we must understand the boundaries of dynamic group rule evaluation and group management.
2
Evaluate the capabilities of group owners and administrative unit-scoped roles.
Group owners cannot modify dynamic rules. Administrative unit-scoped roles are restricted and cannot modify dynamic group queries because the queries evaluate directory-wide properties.
This rules out group ownership and administrative unit scope as viable options for modifying dynamic rules.
3
Compare Microsoft Entra ID directory roles with Azure RBAC roles.
Azure RBAC roles (such as User Access Administrator) manage Azure resources, not Entra ID directory groups. The Groups Administrator role is the least privileged Entra ID directory role that can manage dynamic groups.
This confirms that the Groups Administrator role is the correct and least privileged role for the task.

Key Concept

Microsoft Entra ID group management permissions and dynamic group rules
Rate this question

Topics

Users and Groups in Microsoft Entra ID

More questions from this topic