AZ-104 Question 8
Single answerYour company uses Azure Active Directory to manage users and groups. You have created a new dynamic security group that uses a rule to automatically include employees whose Department property is set to 'Sales.' However, newly created users in the 'Sales' department are not added to the group, and you confirm that the department is correctly set in each user’s profile. Which step should you take to ensure that new users are successfully added to the group?
- A
Convert the group from a security group to a Microsoft 365 group
- B
Enable a service principal for department-based assignment
- C
Create a custom extension attribute to store the Department property
- D
Verify that your membership rule references the correct Department attribute name
Show answer and explanation
Correct answer: D
Explanation
When configuring an Azure AD dynamic security group, the primary issue often lies in how the membership rule is constructed. Department is a native user property in Azure AD, so no additional extension attributes or group type changes are typically required. Verifying the rule uses the correct attribute and syntax for ‘Department’ resolves the issue of users not being added to the group.
- A. Incorrect.
Changing the group type to a Microsoft 365 group is not directly related to the issue of users not being added to the group by a Department-based rule.
- B. Incorrect.
Enabling a service principal for department-based assignment is not required for dynamic membership based on user attributes in Azure AD.
- C. Incorrect.
A custom extension attribute is only needed if you are referencing an attribute not natively available in Azure AD; Department is a built-in attribute, so no custom attribute is required.
- D. Correct.
Azure AD dynamic membership rules rely on the correct attribute name. Ensuring that the membership rule specifically references the built-in 'department' attribute (and not a misspelling or unrelated field) is the key step.