Examkin

Question

Difficulty: EasyUsers and Groups in Microsoft Entra ID

You manage a Microsoft Entra ID tenant that contains a security group named Sales-Group. You need to delegate the management of Sales-Group to a user named User1, allowing them to add and remove members. The solution must minimize the administrative privileges assigned to User1. Which action should you perform?

  1. Add User1 to the owners list of Sales-Group.Answer
  2. B
    Assign the User Administrator role to User1 in Microsoft Entra ID.
  3. C
    Assign the Contributor role to User1 at the Azure subscription level.
  4. D
    Change the membership type of Sales-Group to Dynamic User.

Answer

Add the user to the owners list of the security group.
Adding the user to the owners list of the group allows them to manage the group's membership directly without inheriting any broad directory-level administrative privileges, which aligns with the principle of least privilege.

Step-by-Step Solution

1
Identify the requirement to delegate group membership management for a single group with the least privilege.
Determine that directory-level roles are too privileged.
Directory-level roles like User Administrator grant scope over the entire tenant, which is unnecessary for a single group.
2
Evaluate the difference between group ownership and subscription-level roles.
Azure RBAC roles do not grant rights to manage Entra ID group memberships.
RBAC roles manage Azure resources, whereas directory group management is handled within Microsoft Entra ID.
3
Select group ownership as the delegation method.
Adding the user as an owner of the target group allows manual membership management of only that group.
Group owners can add and remove members directly without needing any administrative directory roles.

Key Concept

Delegating group management in Microsoft Entra ID using group ownership.
Rate this question

Topics

Users and Groups in Microsoft Entra ID

More questions from this topic