Examkin

Soru

Zorluk: OrtaUsers and Groups in Microsoft Entra ID

You are configuring group membership and delegation in a Microsoft Entra ID tenant. You plan to create a security group named DevOps-Staff that dynamically includes all users whose department is Engineering and who are not guest users.

Which of the following statements are correct? (Select TWO.)

  1. The dynamic membership rule must be configured using the query (user.department -eq "Engineering") and (user.userType -ne "Guest").Cevap
  2. B
    To allow the group owner to manually add external contractors as exceptions to the membership, you must configure the group rule to mix user and device attributes.
  3. To delegate the ability to update user attributes (such as department) for a subset of users, you can assign the User Administrator role scoped to an Administrative Unit containing those users.Cevap
  4. D
    An administrator with the Owner role at the Azure subscription scope can modify the group's dynamic membership rules in Microsoft Entra ID.

Cevap

The correct statements are that the dynamic membership rule must be configured using the query (user.department -eq "Engineering") and (user.userType -ne "Guest"), and that the ability to update user attributes for a subset of users can be delegated by assigning the User Administrator role scoped to an Administrative Unit containing those users.
The dynamic membership rule must be configured using the query (user.department -eq "Engineering") and (user.userType -ne "Guest") because it is a syntactically correct OData query that accurately captures both conditions. Additionally, assigning the User Administrator role scoped to an Administrative Unit allows localized delegation of user management (like department updates), which in turn feeds into the dynamic group membership evaluation.

Adım Adım Çözüm

1
Analyze the dynamic membership rule requirement.
The query must target user attributes. The syntax '(user.department -eq "Engineering") and (user.userType -ne "Guest")' correctly uses the OData v3.0 syntax for Microsoft Entra ID dynamic user groups.
Dynamic groups require precise OData queries using supported user properties to evaluate membership automatically.
2
Evaluate the possibility of manual membership modifications in dynamic groups.
Dynamic groups determine membership exclusively via rules; manual additions or exceptions are not permitted.
Once a group is set to Dynamic User or Dynamic Device, its membership list is read-only for manual updates.
3
Evaluate administrative delegation using Administrative Units (AUs).
Assigning a User Administrator role scoped to an Administrative Unit containing the target users allows management of their attributes (like Department), which triggers dynamic rule evaluation and updates membership.
Administrative Units allow restricting the scope of directory roles to specific users and groups for delegation.
4
Evaluate the difference between Azure RBAC and Microsoft Entra ID roles.
An Azure Subscription Owner does not have permissions to modify Microsoft Entra ID directory objects (like groups) unless explicitly assigned a directory role.
Azure RBAC controls access to Azure resources, whereas Microsoft Entra ID roles control directory-level management.

Anahtar Kavram

Microsoft Entra ID group management, dynamic membership rules, administrative units, and directory delegation.
Tahmini Süre:1m 30s
Bu soruyu puanla

Konular

Users and Groups in Microsoft Entra ID

Bu konudan daha fazla soru