AZ-104 Practice Question 3: Entra Dynamic Group Membership
Microsoft Azure Administrator Associate (AZ-104) · Test 1 · question 3 of 10
Contoso hires roughly 40 people a month. Every new employee whose department attribute is set to Sales must automatically receive access to a set of Sales applications, with no ticket and no manual step by the identity team. Leavers whose department changes must lose that access just as automatically.
Which approach meets the requirement, and what does it depend on?
Show answer and explanation
Answer:
A dynamic membership group is populated by a membership rule rather than by an administrator. When a user's attributes change, Microsoft Entra ID re-evaluates every dynamic rule in the directory and adds or removes the user accordingly, so both joiners and department changes are handled with no manual step. The licensing detail matters on the exam: dynamic membership groups require a Microsoft Entra ID P1 license (or Intune for Education) for each unique user who is a member of one or more dynamic groups. Note also that you cannot manually add or remove a member of a dynamic group.
Option A works but is exactly the manual process the stem rules out; a script is another thing to own, monitor, and fix, and membership is stale between runs.
Option B puts the decision in the users' hands. Self-service membership lets people join groups they choose; it does not key membership off the authoritative department attribute, so it grants access to the wrong people.
Option C solves a different problem. An administrative unit scopes *administrative permissions* over a set of users; it does not grant those users access to applications and does not populate group membership.
Reference: Rules for dynamic membership groups in Microsoft Entra ID