Hotspot Question You have an Azure Active Directory (Azure AD) tenant that contains an administrative unit named Department1. Department1 has the users shown in the Users exhibit. (Click the Users…

Question

Exhibits

Options

• AUser1 only
• BUser1 and Group1 only
• CUser1, Group1, and Group2 only
• DUser1, Group1, and Group4 only
• EUser1, Group1, Group2, and Group3 only
• FUser1, Group1, Group2, Group3, and Group4
• GUser1 and Group4 only
• HUser1, Group1, Group2, and Group4 only

• B
  6% (3)
• D
  4% (2)
• E
  75% (38)
• G
  2% (1)
• H
  14% (7)

Explanation

This is a two-part hotspot question where each statement gets its own Yes/No answer, yielding two correct selections: E for the first statement and A for the second.

Why E is correct (first statement): Department1's administrative unit directly contains User1, Group1, Group2, and Group3. Group4 is absent from the AU's membership, so any option including Group4 (D, F, H, G) is wrong. Options A, B, C are wrong because they omit one or more groups that are direct members of the AU.

Why A is correct (second statement): A User Administrator scoped to an AU can only directly manage users assigned to that AU - not users who happen to be members of groups within the AU. Since only User1 is a direct user member of Department1, only User1 falls under the scoped admin's management authority. Group2's members (and members of other groups) are not directly in the AU, so the admin has no jurisdiction over them.

Memory tip: Think of an AU as a walled garden - the scoped admin can only touch what's planted directly inside the wall (direct members), not what grows inside a pot (group members) placed inside the wall. Groups themselves are in scope, but their contents are not.

No community discussion yet for this question.