An administrator is configuring a dynamic group in Microsoft Entra ID named Corporate-Marketing. The administrator wants the group to dynamically include all users from the Marketing department who are currently assigned a corporate Windows 11 laptop. The administrator attempts to save the following membership rule for a group with the membership type set to Dynamic User:
(user.department -eq "Marketing") -and (device.deviceOSVersion -startsWith "10.0.22")
Why does the configuration fail?
- AThe group membership type must be set to Dynamic Device because device properties are referenced in the rule.
- BThe syntax operator -startsWith is invalid and must be replaced with the -like operator.
- A single dynamic membership rule cannot combine user and device attributes; dynamic groups must target either users or devices exclusively.Cevap
- DThe administrator must have the Directory Reader role assigned at the subscription scope to query device properties.
Cevap
A single dynamic membership rule cannot combine user and device attributes; dynamic groups must target either users or devices exclusively.
Microsoft Entra ID dynamic groups support evaluating either user objects or device objects, but a single dynamic rule cannot combine both user and device attributes. The group must be configured with a membership type of either Dynamic User (to evaluate user properties) or Dynamic Device (to evaluate device properties).
Adım Adım Çözüm
Anahtar Kavram
Microsoft Entra ID dynamic groups require a single, distinct object type (either user or device) and cannot mix user and device attributes in a single membership rule.