Examkin

Question

Difficulty: HardUsers and Groups in Microsoft Entra ID

An administrator manages a Microsoft Entra ID tenant that contains an administrative unit named Sales-AU. A dynamic user group named Sales-Dynamic-Group is a member of Sales-AU. A user named Admin1 is assigned the Groups Administrator role scoped to the Sales-AU administrative unit. Admin1 attempts to modify the query of the dynamic membership rule for Sales-Dynamic-Group. What is the outcome of Admin1's attempt to modify the rule?

  1. A
    The update will succeed because the Groups Administrator role scoped to the administrative unit provides full management capabilities for all groups within that administrative unit.
  2. B
    The operation will fail because modifying dynamic rules requires a subscription-level Azure RBAC role such as Owner or Contributor.
  3. The update will fail because dynamic membership rules can only be modified by administrators with group management roles assigned at the tenant scope.Answer
  4. D
    The update will fail because only users with the User Administrator role scoped to the administrative unit are permitted to manage dynamic user group rules.

Answer

The update will fail because dynamic membership rules can only be modified by administrators with group management roles assigned at the tenant scope.
The correct option states that the update will fail because dynamic membership rules can only be modified by administrators with group management roles assigned at the tenant scope. In Microsoft Entra ID, administrative unit scope delegation does not extend to managing dynamic groups, even if the dynamic groups are members of the administrative unit. Dynamic group membership rules require tenant-wide privileges to modify.

Step-by-Step Solution

1
Analyze the current administrative role assignment and scope.
Admin1 has the Groups Administrator role scoped to the Sales-AU administrative unit.
To determine if the user has the required permissions to perform the operation on the group.
2
Identify the type of group being modified.
The target group, Sales-Dynamic-Group, is a dynamic user group.
Microsoft Entra ID enforces different administrative boundaries and delegation rules for assigned groups versus dynamic groups.
3
Apply the administrative unit scope rules for dynamic group management.
Modifying dynamic membership rules is a tenant-level operation. Roles scoped to an administrative unit cannot modify dynamic groups.
Because dynamic rules are evaluated tenant-wide, Microsoft Entra ID prevents administrative unit scoped administrators from creating or modifying them to maintain security boundaries.
4
Determine the necessary administrative level and role for resolution.
Admin1 requires the Groups Administrator (or Global Administrator) role assigned at the tenant (directory) scope.
This directory-level permission is the minimum privilege required to modify dynamic membership rules.

Key Concept

Delegating group management with administrative units and directory roles
Estimated Time:2m 0s
Rate this question

Topics

Users and Groups in Microsoft Entra ID

More questions from this topic