hardMultiple Choice
MS-102 Practice Question: A company uses dynamic groups based on department…
A company uses dynamic groups based on department attribute. A user moved from Sales to Marketing but the group membership did not update after 48 hours. What should the admin do first?
⚠ Common exam trap
Watch out — candidates often assume dynamic group membership updates are instantaneous or that PowerShell can force a refresh, when in fact the only supported manual trigger is through the Azure portal or Graph API, and waiting is not the first recommended action.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Manually refresh the dynamic group in Microsoft Entra ID
Microsoft Entra ID dynamic group membership evaluation is not instantaneous; it occurs on a periodic schedule. When a user's attribute changes, the admin can manually trigger a refresh by selecting 'Refresh' on the dynamic group's overview page in the Azure portal, which forces an immediate evaluation of the membership rules. This is the first troubleshooting step before waiting longer or using other methods.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Delete and recreate the group
Why it's wrong here
Deleting and recreating the group is unnecessarily destructive and does not address the root cause. The group's object ID, Microsoft Entra ID role assignments, license assignments, and access packages tied to that group would be lost, and the newly created group would still rely on the same asynchronous dynamic membership evaluation. If the original group failed to evaluate the department attribute correctly, a clean copy will likely exhibit the same delay unless a manual reprocessing is performed.
- ✗
Run a PowerShell script to update membership
Why it's wrong here
PowerShell cannot be used to manually add or remove members from a mail-enabled security group or Microsoft 365 group that is governed by a dynamic membership rule. The Set-AzureADGroup and Add-AzureADGroupMember cmdlets fail or throw a DirectoryObjectNotFound/NotSupported error because membership is owned and calculated by the Microsoft Entra ID rule engine, not by client-side scripts. There is no supported PowerShell cmdlet that forces a dynamic group evaluation; that capability is available only through the manual Refresh action in the portal or the corresponding Graph API operation.
- ✗
Wait another 24 hours
Why it's wrong here
The default dynamic membership evaluation process can take up to 48 hours in large tenants because Microsoft Entra ID batching and incremental processing depend on many factors. Waiting another 24 hours might happen to coincide with the next evaluation cycle, but it is not a deterministic troubleshooting step and does not force a recalculation when an attribute change was missed or the membership hasn't been processed. An administrator can use the manual Refresh option to trigger immediate processing and verify whether the department attribute is actually synchronized to Entra ID.
- ✓
Manually refresh the dynamic group in Microsoft Entra ID
Why this is correct
In the Microsoft Entra admin center, navigate to Groups, open the specific dynamic group, and select the Manual Refresh (or Reprocess) action from the Dynamic membership rules pane to immediately trigger recalculation. This operation forces Microsoft Entra ID to re-run the membership query against current user attribute values, including the department field, and to add or remove members accordingly. This is the supported way to resolve stale dynamic group membership without recreating the group or using unsupported PowerShell commands.
Go deeper
Related to this question
Learn chapter
Named Locations and Network-Based Policies
Key term
Microsoft Entra ID
Microsoft Entra ID is a cloud-based identity and access management service that lets employees sign in and access resources both inside and outside of your organization.
Key term
Dynamic group
A dynamic group is a group in Microsoft Entra ID (Azure AD) whose membership is automatically updated based on user or device attributes, rather than being manually assigned.
About these practice questions
One of 712 original MS-102 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MS-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MS-102 exam.