Examkin

Question

Difficulty: MediumUsers and Groups in Microsoft Entra ID

You manage a Microsoft Entra ID tenant. You have an existing security group named Group1. During the creation of Group1, the option 'Microsoft Entra roles can be assigned to the group' was set to Yes. You now need to configure Group1 to automatically add users who have their department attribute set to 'Engineering'. What should you do?

  1. Create a new security group, set 'Microsoft Entra roles can be assigned to the group' to No, and configure a dynamic user membership rule.Answer
  2. B
    Modify the properties of Group1 to change the membership type from Assigned to Dynamic User, and configure the dynamic membership rule.
  3. C
    Assign the User Administrator role to Group1, and then update the membership type to Dynamic User.
  4. D
    Create a new administrative unit, add Group1 to the administrative unit, and apply a dynamic membership rule to the administrative unit.

Answer

Create a new security group, set 'Microsoft Entra roles can be assigned to the group' to No, and configure a dynamic user membership rule.
In Microsoft Entra ID, groups that are role-assignable (where 'Microsoft Entra roles can be assigned to the group' is set to Yes) must use the 'Assigned' membership type. Dynamic membership rules are not supported for these groups to maintain security and prevent unauthorized privilege escalation. Therefore, to automate membership based on user attributes like department, you must create a new group that is not role-assignable.

Step-by-Step Solution

1
Analyze the properties of the existing group (Group1) to identify any constraints.
Group1 is identified as a role-assignable group since the option 'Microsoft Entra roles can be assigned to the group' was enabled during creation.
Role-assignable groups have strict configuration limitations that differ from standard security groups.
2
Evaluate if the membership type of a role-assignable group can be converted to dynamic.
Microsoft Entra ID enforces that role-assignable groups must use the 'Assigned' membership type; dynamic membership rules (Dynamic User or Dynamic Device) cannot be used.
To prevent administrative privilege escalation or unintended role assignments via membership rules, Entra ID restricts membership of role-assignable groups to manual/assigned membership only.
3
Formulate a solution that allows the use of dynamic membership rules for the target users.
A new security group must be created with the 'Microsoft Entra roles can be assigned to the group' option set to 'No', allowing its membership type to be configured as Dynamic User with the department-based rule.
Since the existing role-assignable group cannot be converted to dynamic, creating a new non-role-assignable group is the only way to automate membership based on user attributes.

Key Concept

Membership constraints on role-assignable groups in Microsoft Entra ID
Estimated Time:1m 30s
Rate this question

Topics

Users and Groups in Microsoft Entra ID

More questions from this topic