Examkin

Soru

Zorluk: OrtaUsers and Groups in Microsoft Entra ID

You are planning to delegate user management tasks in a Microsoft Entra ID tenant. You need to create a new group named Identity-Managers and assign the User Administrator role directly to this group. Which configuration is required for the Identity-Managers group?

  1. A
    The group membership type must be set to Dynamic User with a rule that automatically includes users whose job title is Helpdesk Specialist.
  2. The group membership type must be set to Assigned, and the option to assign Microsoft Entra roles must be enabled during group creation.Cevap
  3. C
    The group can be created with standard settings, and the User Administrator role must be assigned using Azure RBAC at the resource group scope.
  4. D
    The group must be added to an Administrative Unit, which automatically elevates all members of the group to the User Administrator role at the tenant level.

Cevap

The group membership type must be set to Assigned, and the option to assign Microsoft Entra roles must be enabled during group creation.
The correct option is correct because assigning a Microsoft Entra ID role to a group requires creating a role-assignable group. This type of group must have the role-assignable property enabled during creation and only supports the 'Assigned' membership type to guarantee administrative oversight over the group's members.

Adım Adım Çözüm

1
Identify the type of role being assigned.
The User Administrator role is a Microsoft Entra ID directory-level role, not an Azure RBAC role.
Entra ID directory roles have different assignment requirements and APIs compared to Azure resource role-based access control.
2
Determine group requirements for Microsoft Entra ID directory roles.
The target group must have its 'isAssignableToRole' attribute set to true. This property can only be set at group creation time and cannot be modified later.
This restriction ensures that unauthorized administrators cannot turn a regular group into a role-assignable group to elevate their own privileges.
3
Verify group membership restrictions for role-assignable groups.
The membership type must be 'Assigned'. Dynamic groups (Dynamic User or Dynamic Device) cannot be assigned to roles.
Using dynamic groups for role assignment would allow automatic, query-based privilege elevation, which presents a significant security risk.

Anahtar Kavram

Microsoft Entra ID role-assignable groups require the 'Assigned' membership type and must have the role assignment setting enabled at the time of creation.
Bu soruyu puanla

Konular

Users and Groups in Microsoft Entra ID

Bu konudan daha fazla soru