Examkin

Question

Difficulty: HardUsers and Groups in Microsoft Entra ID

You plan to configure a new dynamic user group in Microsoft Entra ID. The group must automatically include all users who are members of an existing security group named Marketing-All (which has an Object ID of 11111111-2222-3333-4444-555555555555) and also have their department attribute set to Marketing. You write the following dynamic membership rule for the group:

`user.memberof -any (group.objectId -in ['11111111-2222-3333-4444-555555555555']) -and user.department -eq 'Marketing'`

Will Microsoft Entra ID successfully validate and save this dynamic membership rule?

Answer: Answer

Answer

False
Microsoft Entra ID does not support combining the `memberOf` property with other user attributes (such as `user.department`) in a single dynamic group membership rule expression. A dynamic group rule using `memberOf` can only reference other groups and cannot include additional user-specific filters.

Step-by-Step Solution

1
Analyze the proposed dynamic membership rule syntax and properties used.
The rule uses `user.memberof` to check membership in a specific group and combines it with a check on the `user.department` property using the `-and` operator.
To determine if the rule is valid, we must evaluate the constraints of Microsoft Entra ID dynamic group membership rules.
2
Recall the limitations of the `memberOf` attribute in dynamic group rules.
Microsoft Entra ID prohibits combining the `memberOf` attribute with any other attributes or query terms within the same dynamic group rule expression.
This is a platform-enforced limitation of dynamic group evaluation.
3
Evaluate the outcome of saving the rule.
Since the rule attempts to combine `user.memberof` and `user.department` using `-and`, validation will fail, and the portal will not allow the rule to be saved.
The rule violates the structural constraints of dynamic group membership rule configurations.

Key Concept

Microsoft Entra ID dynamic group membership rules cannot combine the 'memberOf' attribute with other user or device properties in a single rule.
Rate this question

Topics

Users and Groups in Microsoft Entra ID

More questions from this topic