You have an Azure AD tenant that contains two users named User1 and User2. You plan to perform the following actions: - Create a group named Group1. - Add User1 and User2 to Group1. - Assign Azure AD roles to Group1. You need to create Group1. Which two settings can you use? Each correct answer presents a complete solution. NOTE: Each correct selection is worth one point.

Microsoft

SC-300 · Question #203

You have an Azure AD tenant that contains two users named User1 and User2. You plan to perform the following actions: - Create a group named Group1. - Add User1 and User2 to Group1. - Assign Azure…

The correct answer is A. Group type: Microsoft 365 B. Group type: Security. Explanation To assign Azure AD roles to a group, the group must have the "Azure AD roles can be assigned to the group" setting enabled during creation - this option is only available for Security groups and Microsoft 365 groups, making both Group types valid choices. Option A…

Submitted by andreas_gr· Mar 6, 2026Implement authentication and access management

Question

You have an Azure AD tenant that contains two users named User1 and User2. You plan to perform the following actions:

Create a group named Group1.
Add User1 and User2 to Group1.
Assign Azure AD roles to Group1.

You need to create Group1. Which two settings can you use? Each correct answer presents a complete solution. NOTE: Each correct selection is worth one point.

Options

AGroup type: Microsoft 365
BGroup type: Security
CGroup type: Security
DGroup type: Microsoft 365
EGroup type: Security

How the community answered

(21 responses)

A
95% (20)
D
5% (1)

Explanation

To assign Azure AD roles to a group, the group must have the "Azure AD roles can be assigned to the group" setting enabled during creation - this option is only available for Security groups and Microsoft 365 groups, making both Group types valid choices. Option A (Microsoft 365) and Option B (Security) are correct because both group types support role-assignable groups when that toggle is enabled at creation time, which is a permanent setting that cannot be changed later.

The remaining options (C, D, E) appear to be duplicates of A and B in this question, which suggests a formatting issue in the source material - they do not represent distinct configurations and therefore add no additional valid solutions.

Memory Tip: Think "S.M.A.R.T. roles" - only Security and Microsoft 365 groups can be made role-assignable. Distribution groups cannot be assigned Azure AD roles under any circumstances. Also remember: the role-assignable setting must be enabled at creation - you cannot retrofit it onto an existing group!

Topics

#Azure AD Groups#Role-assignable groups#Group types#Azure AD roles

Community Discussion

No community discussion yet for this question.

Full SC-300 Practice