You have an on-premises Active Directory Domain Services (AD DS) domain that syncs with an Azure Active Directory (Azure AD) tenant. Group writeback is enabled in Azure AD Connect. The AD DS domain…

Question

Options

• Ain the AD DS domain, create a universal security group
• Bin the Azure AD tenant create a security group that has assigned membership
• Cin the Azure AD Tenant create a security group that has dynamic membership.
• Din the Azure AD tenant create a Microsoft 365 group

• A
  3% (1)
• B
  79% (31)
• C
  13% (5)
• D
  5% (2)

Explanation

The requirements are to authorize access to both an on-premises share (share1) and an Azure Storage share (share2 using Azure AD-based access control), and the group must be able to contain AD DS users. Because Group Writeback is enabled in Azure AD Connect, a security group created in the Azure AD tenant with assigned membership will be written back to the on-premises AD DS domain. This allows the group to be used to assign NTFS/share permissions for share1 (via the written-back group in AD DS) and Azure RBAC permissions for share2. Dynamic membership groups cannot be written back to AD DS. Microsoft 365 groups are not supported for Azure Storage RBAC. A pure AD DS universal security group cannot directly authorize access to Azure AD-based storage.

No community discussion yet for this question.