Secure identity and access →easyMultiple Choice

AZ-500 Secure identity and access Practice Question

Exhibit

Refer to the exhibit.

Get-AzureADUser -ObjectId user@contoso.com | Select-Object UserPrincipalName, UserType

UserPrincipalName   UserType
-----------------   --------
user@contoso.com    Member

Refer to the exhibit. You run the command and see the output. What does the UserType 'Member' indicate?

⚠ Common exam trap

Many candidates confuse the UserType property with the user's role or administrative status, when in fact UserType only distinguishes between native tenant members and external B2B guests, not their permissions or directory roles.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The user is a member of the tenant

The UserType 'Member' indicates that the user is a member of the tenant, meaning the user's identity is native to the Microsoft Entra ID tenant and not from an external directory. This is distinct from 'Guest' (UserType = Guest), which represents external users invited via B2B collaboration. The command shown is likely Get-AzureADUser or a similar cmdlet, where the UserType property directly reflects the user's relationship to the tenant.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The user is a service principal
Why it's wrong here
A service principal is an application identity object in Microsoft Entra ID, not a user object, so it cannot be returned by a command that queries directory users such as Get-AzureADUser or Microsoft Graph /users. Service principals are stored in a separate object class and are retrieved via the ServicePrincipals endpoint; they do not have a UserType property with values like Member or Guest. Therefore, the output, which shows UserType: Member, proves the object is a user, not a service principal.
✗
The user is a guest user
Why it's wrong here
Guest users in Microsoft Entra B2B collaboration are assigned the UserType value 'Guest' to reflect that they originate from another directory, consumer Microsoft account, or external identity provider. When you invite an external user, Microsoft Entra ID creates a user object in the resource tenant with UserType set to 'Guest', not 'Member'. Since the output explicitly shows UserType as Member, the user cannot be a guest; guests would display UserType Guest, often accompanied by InvitationState and ExternalUserState properties.
✗
The user is an administrator
Why it's wrong here
The UserType property indicates whether the account is a member of the tenant directory (Member) or an external guest user (Guest); it does not encode any administrative role or privileged role assignment. An internal user may be a standard employee with no Microsoft Entra ID administrator roles, while a guest account can actually be assigned administrative roles. To determine whether the user is an administrator, you would need to inspect directory role assignments via roleManagement or memberOf, not infer it from UserType, so the output alone cannot support that conclusion.
✓
The user is a member of the tenant
Why this is correct
When the output shows UserType 'Member', it means the user account is an internal, home-directory member of the Microsoft Entra ID tenant. Such users are typically created directly in that tenant or synchronized from on-premises Active Directory via Microsoft Entra Connect, and they belong to the tenant organization rather than being invited from outside. This is precisely the correct interpretation: the command returned a user object whose directory membership type is Member, so the user is a member of the tenant.

Go deeper

AZ-500 Secure identity and access Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question