Examkin

Question

Difficulty: MediumAdministrative Units and License Management

An organization has a Microsoft Entra ID tenant. The tenant contains a user named Admin1, a security group named Europe-Sales that has 50 member users, and an administrative unit named Europe-AU. Europe-AU contains the Europe-Sales group as its only member.

You assign the User Administrator role to Admin1 with Europe-AU as the scope.

Which action is Admin1 permitted to perform?

  1. Add new members to the Europe-Sales groupAnswer
  2. B
    Reset the passwords of the users who are members of the Europe-Sales group
  3. C
    Assign the Virtual Machine Contributor role to the Europe-Sales group for an Azure resource group
  4. D
    Configure a dynamic membership rule for the Europe-Sales group based on user attributes

Answer

Add new members to the Europe-Sales group
An administrator assigned the User Administrator role at the Administrative Unit (AU) scope can manage the properties and membership of groups that are direct members of the AU. Since Europe-Sales is a member of Europe-AU, Admin1 can add or remove members from it.

Step-by-Step Solution

1
Identify the role and scope assignment
Admin1 is assigned the User Administrator role scoped to the Europe-AU Administrative Unit.
This determines the boundary of the administrator's management capabilities.
2
Determine the direct members of the Administrative Unit
The Europe-Sales group is the only direct member of Europe-AU. The individual users within the group are not direct members of the AU.
Administrative Unit scope is non-transitive. Only objects directly added to the AU are within the management scope.
3
Evaluate the administrative permissions on the group object versus its members
Admin1 can perform group management actions on Europe-Sales (such as updating properties and managing membership) but cannot perform user management actions (such as password resets) on the group's members.
To manage the users inside the group, those users must be explicitly added as direct members of the Europe-AU.

Key Concept

Administrative Unit scoping and the non-transitive nature of group memberships in Microsoft Entra ID
Estimated Time:1m 30s
Rate this question

Topics

Administrative Units and License Management

More questions from this topic