AZ-104 Question 2
Single answerYou are an Azure Administrator for a company that uses Microsoft Entra for identity management. The HR department requests that any new user hired into the 'Sales' department is automatically added to the 'SalesTeam' group without requiring manual updates. Which action should you take to ensure these users are instantly assigned to the correct group upon hire?
- A
Edit the 'SalesTeam' group membership to require approval-based joining for all new hires
- B
Define a dynamic membership rule that adds members with Department set to 'Sales' to the 'SalesTeam' group
- C
Convert the 'SalesTeam' group into a Microsoft 365 group and enable self-service membership
- D
Create a script to run nightly that queries each new user’s department and updates group membership
Show answer and explanation
Correct answer: B
Explanation
Dynamic membership in Microsoft Entra (Azure AD) automatically assigns users to groups based on their user attributes, such as Department. Defining a rule that checks whether the Department attribute is set to 'Sales' ensures all new 'Sales' employees are added to the 'SalesTeam' group without manual intervention.
- A. Incorrect.
Approval-based joining only allows users to request membership but doesn’t automate assignment based on user attributes, so it’s not suitable for automatic assignment.
- B. Correct.
A dynamic membership rule in Microsoft Entra (Azure AD) uses a user’s department or other attributes to grant or remove group membership automatically.
- C. Incorrect.
Changing the group type to a Microsoft 365 group and enabling self-service membership would still require users to manually join, which does not meet the requirement for automatic assignment.
- D. Incorrect.
While scripting could theoretically manage membership, it requires ongoing maintenance and does not leverage native Azure AD dynamic membership capabilities, making it less efficient and more prone to error.