Hotspot Question You have an Azure subscription that contains the resources shown in the following table. The subscription is linked to an Azure Active Directory (Azure AD) tenant that contains the…

Question

Exhibits

Answer Area

• User1 is a member of Group1 and Group2.Yes
• User2 is a member of Group2 only.No
• Managed1 is a member of Group1 and Group2.No

Explanation

This question assesses understanding of Azure AD dynamic group membership rules.

The dynamic membership rule for both Group1 and Group2 (which are 'Dynamic User' type) is defined as: (user.accountEnabled -eq true) or (user.usageLocation -eq "US").

Let's evaluate each statement:

• User1 is a member of Group1 and Group2. => Yes

  • User1's usage location is "United States" (US).
  • Applying the rule, (user.usageLocation -eq "US") evaluates to true for User1. Since the condition uses an OR operator, User1 meets the membership criteria.
  • As both Group1 and Group2 are 'Dynamic User' groups governed by this rule, User1 will be a member of both. Therefore, the statement is true.

• User2 is a member of Group2 only. => No

  • User2's usage location is "Germany".
  • Assuming User2's account is enabled (user.accountEnabled -eq true), the first part of the rule is true. The second part, (user.usageLocation -eq "US"), is false for User2.
  • However, because the condition uses an OR operator, and (user.accountEnabled -eq true) is true, User2 meets the overall membership criteria.
  • Since User2 meets the criteria and both Group1 and Group2 are 'Dynamic User' groups, User2 will be a member of both Group1 and Group2, not Group2 only. Therefore, the statement is false.

• Managed1 is a member of Group1 and Group2. => No

  • Managed1 is a "Managed identity".
  • Group1 and Group2 are specified as 'Dynamic User' type groups.
  • Dynamic User groups are designed to contain user objects, and their membership rules (like user.accountEnabled and user.usageLocation) are based on user properties. Managed identities are service principals, not user objects.
  • Therefore, a Managed Identity cannot be a member of a 'Dynamic User' group. The statement is false.

No community discussion yet for this question.