Hotspot Question You have two Microsoft Entra tenants named contoso.com and fabrikam.com. Contoso.com contains the users shown in the following table. Contoso.com contains the groups shown in the…

Question

Answer Area

• User1 will sync to fabrikam.com.No
• User2 will sync to fabrikam.com.Yes
• User3 will sync to fabrikam.com.Yes

Explanation

To correctly answer, one must understand the scoping rules for Microsoft Entra cross-tenant synchronization, particularly how individual users and group memberships are affected when specific objects are enabled for sync.

Approach. The core of this question lies in understanding which objects are included in a cross-tenant synchronization scope. The question states that cross-tenant synchronization is enabled for User3 and Group2 from contoso.com to fabrikam.com. Based on this:

1. User1 will sync to fabrikam.com. -> No

   • User1 is a member of Group1. The question explicitly states that only Group2 (and User3) is enabled for synchronization. Group1 is not enabled, and User1 is not individually enabled. Therefore, User1 will not sync.

2. User2 will sync to fabrikam.com. -> Yes

   • User2 is a member of Group2. The question explicitly states that Group2 is enabled for synchronization. When a group is enabled for cross-tenant synchronization, all its members are implicitly included in the synchronization scope. Therefore, User2 will sync.

3. User3 will sync to fabrikam.com. -> Yes

   • The question explicitly states that User3 is enabled for cross-tenant synchronization. When an individual user is enabled, they will sync. Therefore, User3 will sync.

Common mistakes.

• common_mistake. A common mistake is to assume that all users, regardless of their direct inclusion or group's sync status, will synchronize, or conversely, that group members require individual enablement even if the group itself is enabled. For instance, selecting 'Yes' for User1 would be incorrect because User1 is only a member of Group1, and Group1 is not in the synchronization scope. Another mistake could be selecting 'No' for User2, perhaps thinking that even if Group2 syncs, its members need separate explicit enablement, which is incorrect for group-based scoping. Similarly, neglecting the explicit inclusion of User3 and selecting 'No' would be wrong.

Concept tested. Microsoft Entra (formerly Azure AD) cross-tenant synchronization scoping rules, including how individual users and group memberships are included when objects are enabled for synchronization.

No community discussion yet for this question.