Examkin

Question

Difficulty: HardUsers and Groups in Microsoft Entra ID

An organization has a Microsoft Entra ID tenant. The tenant contains a dynamic security group named IT-Personnel and an administrative unit named IT-AU. The IT-Personnel group is a member of IT-AU. A user named Admin1 is assigned the Groups Administrator role scoped to IT-AU. You need to determine if Admin1 can update the dynamic query that defines the membership of the IT-Personnel group.

Is the statement 'Admin1 can modify the dynamic membership rule of the IT-Personnel group' true or false?

Answer: Answer

Answer

False
The correct answer is False because administrative unit-scoped directory roles do not grant permissions to modify the membership rules of dynamic groups. Changing the query definition of a dynamic group requires a tenant-wide administrator role.

Step-by-Step Solution

1
Analyze the administrator's scoped role assignment.
Admin1 has the Groups Administrator role scoped to the IT-AU administrative unit.
This establishes the scope boundary of Admin1's administrative authority.
2
Determine the capabilities of a Groups Administrator role scoped to an administrative unit.
An administrative unit-scoped Groups Administrator can manage standard properties, licenses, and member lists of assigned groups in their scope.
To distinguish permissions between assigned and dynamic groups.
3
Evaluate permissions required to modify dynamic group membership rules.
Modifying dynamic group membership rules is a tenant-wide action requiring tenant-level roles, such as tenant-level Groups Administrator or Global Administrator.
To verify that administrative unit delegation does not cover dynamic query modifications.

Key Concept

Delegated administrative permissions and their limitations on dynamic groups within Microsoft Entra ID Administrative Units.
Rate this question

Topics

Users and Groups in Microsoft Entra ID

More questions from this topic