nerdexam
Microsoft

SC-300 · Question #428

Hotspot Question You have a Microsoft Entra tenant that contains an administrative unit named AU1. AU1 is configured for assigned membership. The tenant contains the users shown in the following table

The correct answer is HR is a member of AU1. = No; User1 is a member of AU1. = Yes; User2 is a member of AU1. = Yes. When an Administrative Unit (AU) is converted to Dynamic User membership, only individual user objects can be dynamically added based on matching rules - groups are never direct members of an AU configured for Dynamic User membership. User1 is a member of AU1 because their depart

Submitted by parkjh· Mar 6, 2026Manage identities in Microsoft Entra ID - specifically configuring and understanding Administrative Unit membership types (assigned vs. dynamic) and how dynamic user rules evaluate individual user attributes rather than group memberships.

Question

Hotspot Question You have a Microsoft Entra tenant that contains an administrative unit named AU1. AU1 is configured for assigned membership. The tenant contains the users shown in the following table. The tenant contains the groups shown in the following table. For AU1, you update the following configurations: - Membership type: Dynamic User - Dynamic membership rule: (user.department -eq "hr") For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point. Answer:

Exhibit

SC-300 question #428 exhibit

Answer Area

  • HR is a member of AU1.No
  • User1 is a member of AU1.Yes
  • User2 is a member of AU1.Yes

Explanation

When an Administrative Unit (AU) is converted to Dynamic User membership, only individual user objects can be dynamically added based on matching rules - groups are never direct members of an AU configured for Dynamic User membership. User1 is a member of AU1 because their department attribute matches 'hr' (case-insensitive comparison in dynamic rules). User2 is not a member because, although they may belong to the HR group, dynamic AU membership evaluates individual user attributes directly, not group memberships - meaning User2's department attribute does not equal 'hr'.

Topics

#Microsoft Entra ID#Administrative Units#Dynamic Membership Rules#Identity Governance

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full SC-300 Practice