Examkin

Soru

Zorluk: ZorSelf-Service Password Reset and External Identities

An organization has a Microsoft Entra ID tenant with the following configurations:

* Self-Service Password Reset (SSPR) is enabled for a selected security group named SSPR-Group.
* SSPR-Group is a dynamic group that contains User1 and User2 as direct members.
* A security group named Nested-Group is added as a direct member of SSPR-Group. User3 is a direct member of Nested-Group.
* In the External collaboration settings, Guest invite settings is set to "Only users assigned to specific admin roles can invite guest users".
* User1 is assigned the Directory Writers role.
* User2 is assigned the Guest Inviter role.
* User3 is a standard user with no administrator roles.

Which users can perform a self-service password reset, and which users can invite external guest users?

  1. User1 and User2 can perform SSPR; only User2 can invite external guest users.Cevap
  2. B
    User1, User2, and User3 can perform SSPR; only User2 can invite external guest users.
  3. C
    User1 and User2 can perform SSPR; User1 and User2 can invite external guest users.
  4. D
    Only User1 can perform SSPR; only User2 can invite external guest users.

Cevap

User1 and User2 can perform SSPR; only User2 can invite external guest users.
The correct option is correct because User1 and User2 are direct members of SSPR-Group, making them eligible for SSPR. SSPR does not support nested group memberships, so User3 (a member of the nested Nested-Group) cannot perform SSPR. Under the restrictive guest invite settings, only specific admin roles (such as Global Administrator, User Administrator, and Guest Inviter) can invite guests. Since User2 is a Guest Inviter, they can invite guests, whereas User1 (Directory Writers) and User3 (no role) cannot.

Adım Adım Çözüm

1
Determine which users are within the scope of the Self-Service Password Reset (SSPR) policy.
User1 and User2 are direct members of SSPR-Group, which is the scoped group for SSPR. User3 is a member of Nested-Group, which is nested inside SSPR-Group.
SSPR applies only to direct members of the configured group. SSPR does not support nested groups. Therefore, only direct members (User1 and User2) are enabled for SSPR.
2
Analyze the guest invitation policy and evaluate which users are allowed to invite guests.
The Guest invite settings are set to 'Only users assigned to specific admin roles can invite guest users'. The roles allowed under this setting are Global Administrator, User Administrator, and Guest Inviter.
Other directory roles, such as Directory Writers, do not grant the permission to invite guest users under this restrictive setting. Standard users also cannot invite guests.
3
Map user roles to the permitted guest invitation roles.
User2 has the Guest Inviter role and can invite guests. User1 (Directory Writers) and User3 (no role) cannot invite guests.
Only User2 meets the role requirements specified by the guest invite settings.

Anahtar Kavram

Self-Service Password Reset (SSPR) scoping limitations and Entra ID B2B Guest invitation role requirements.
Bu soruyu puanla

Konular

Self-Service Password Reset and External Identities

Bu konudan daha fazla soru