Examkin

Soru

Zorluk: OrtaUsers and Groups in Microsoft Entra ID

An administrator needs to create a new Microsoft Entra ID group that will be assigned directly to the built-in Helpdesk Administrator role. Which of the following settings must be configured during the creation of this group? (Select TWO.)

  1. Set the 'Microsoft Entra roles can be assigned to the group' property to Yes.Cevap
  2. Set the Membership type to Assigned.Cevap
  3. C
    Set the Membership type to Dynamic User.
  4. D
    Assign an Azure RBAC Owner role to the group at the subscription level to authorize directory role assignment.
  5. E
    Assign the group to an Administrative Unit to grant the group members access to manage Azure virtual machines.

Cevap

To assign a Microsoft Entra ID role directly to a group, the group must have its 'Microsoft Entra roles can be assigned to the group' property set to 'Yes' at the time of creation, and its membership type must be set to 'Assigned'.
The correct configurations are setting 'Microsoft Entra roles can be assigned to the group' to Yes and configuring the membership type to Assigned. Security groups that can be assigned directly to Microsoft Entra ID roles must have the role-assignable setting enabled during group creation (as this cannot be enabled post-creation) and must have their membership statically managed via the Assigned membership type.

Adım Adım Çözüm

1
Identify the type of group and setting required for assigning built-in Microsoft Entra ID roles.
A security group must be created with the 'Microsoft Entra roles can be assigned to the group' property set to Yes.
This property enables the group to be assigned directly to directory-level administrative roles.
2
Determine the membership type requirements for role-assignable groups.
The membership type must be set to Assigned.
Microsoft Entra ID does not support dynamic groups (Dynamic User or Dynamic Device) for role-assignable groups to ensure access control stability and prevent unauthorized privilege escalation.

Anahtar Kavram

Role-assignable groups in Microsoft Entra ID must have the 'isAssignableToRole' property enabled at creation and must use the 'Assigned' membership type.
Bu soruyu puanla

Konular

Users and Groups in Microsoft Entra ID

Bu konudan daha fazla soru