MS-102 Practice Question: Deploying Microsoft 365 and wants to ensure that…

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Create a security group with explicit membership and assign licenses to the group.

  Why it's wrong here

  A static security group with explicit membership relies on an administrator to manually add or remove each user as their job role changes. While group-based licensing itself works, this approach is error-prone and does not scale for a department of many users because membership is not derived from any directory attribute. If a finance employee's department attribute changes, they will not automatically be added to or removed from the group, potentially leading to over-assignment or under-assignment of licenses.

• ✓

  Create a dynamic Microsoft Entra ID group based on department attribute and assign licenses using group-based licensing.

  Why this is correct

  Creating a dynamic Microsoft Entra ID group with a rule such as user.department -eq 'Finance' ensures that users are automatically added to the group when their department attribute matches and removed when it changes. When you assign licenses using group-based licensing, the license is automatically applied to every member and automatically removed from users who are removed from the group. This fully automates the lifecycle of license assignment, eliminating manual intervention and ensuring compliance with the department's actual headcount.

• ✗

  Assign licenses to users one by one in the Microsoft 365 admin center.

  Why it's wrong here

  Assigning licenses individually in the Microsoft 365 admin center requires an administrator to navigate to each user account and manually select products. This approach is not only time-consuming for a large finance department but also provides no ongoing automation—when new users join or existing users change departments, the admin must remember to update each user's license manually. The admin center's per-user interface does not have a built-in mechanism to apply licenses based on an organizational attribute, so it cannot react to attribute changes in real time.

• ✗

  Use PowerShell to assign licenses based on user department attribute.

  Why it's wrong here

  A PowerShell script that filters users by department and assigns licenses is a point-in-time operation that must be scheduled or rerun whenever the finance roster changes. The script must also implement logic to remove licenses from users who no longer match the department attribute, and it must handle error conditions such as already-licensed users or users in a state that cannot accept a license. Maintaining such a script across tenant changes, module updates, and permission changes adds ongoing overhead, whereas a dynamic group with group-based licensing provides native, server-side automation without custom code.

Go deeper

Related to this question