hardMultiple Select
MS-102 Practice Question: Which THREE conditions can be used in a dynamic…
Which THREE conditions can be used in a dynamic group rule for a device?
⚠ Common exam trap
Test-takers frequently confuse user attributes (like `lastLogonTimestamp` and `passwordLastSet`) with device attributes, leading them to incorrectly select options that are valid only for user-based dynamic groups.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
deviceModel
`deviceModel` is a valid attribute that can be used in a dynamic group rule for devices in Microsoft Entra ID (formerly Azure AD). Dynamic group rules for devices support attributes such as `deviceModel`, `deviceCategory`, and `deviceOSVersion` to automatically include or exclude devices based on their hardware or software characteristics.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
deviceModel
Why this is correct
deviceModel is a valid device attribute representing the manufacturer-assigned model name (e.g., 'Surface Pro 8' or 'iPhone 13'). Dynamic group rules can reference it directly with the syntax (device.deviceModel -eq "Surface Pro 8") to automatically include or exclude devices by hardware model. It is populated during device enrollment or via management tools like Microsoft Intune and is frequently used to target specific device lines for configuration or access policies.
- ✓
deviceCategory
Why this is correct
deviceCategory is a custom, admin-defined string attribute on device objects that classifies devices into groups such as 'Sales', 'Executive', or 'Kiosk'. It is a valid attribute for dynamic device group rules, e.g., (device.deviceCategory -eq "Executive"), enabling automatic membership based on business or functional categories. Unlike deviceModel, this attribute is not automatically populated; it must be set manually in Microsoft Entra ID/Intune or via an automated process before it can be used effectively.
- ✓
deviceOSVersion
Why this is correct
deviceOSVersion is a valid device attribute that contains the operating system version string, such as '10.0.19044' for Windows 10/11 or '15.0' for iOS. Dynamic group rules can use it with operators like -eq or -startsWith, for example (device.deviceOSVersion -startsWith "10.0"), to target all devices running a specific OS version. Note that the format varies by OS, so you may also need to combine it with deviceOSType (e.g., Windows, iOS) in the rule for accurate matching.
- ✗
lastLogonTimestamp
Why it's wrong here
lastLogonTimestamp is a user attribute, not a device attribute, in Microsoft Entra ID; it records the time of a user's last sign-in and is used in user-focused scenarios like stale account reports or user dynamic group rules. Device dynamic group rules can only evaluate properties of the device object, and lastLogonTimestamp is not among those properties. Referencing it in a device rule causes validation failure, so you cannot use it to build a device group based on when a device was last used.
- ✗
passwordLastSet
Why it's wrong here
passwordLastSet is a user object attribute that tracks when a user's password was last changed; it does not exist on the device object schema in Microsoft Entra ID. Because dynamic group rules for devices can only reference device-specific attributes such as deviceModel, deviceCategory, or deviceOSVersion, any attempt to use passwordLastSet in a device rule will be rejected as invalid. If you need to filter users by password age, use a user-based dynamic group rule instead of a device-based rule.
Go deeper
Related to this question
Learn chapter
Entra ID Administration
Key term
Microsoft Entra ID
Microsoft Entra ID is a cloud-based identity and access management service that lets employees sign in and access resources both inside and outside of your organization.
Key term
Dynamic group
A dynamic group is a group in Microsoft Entra ID (Azure AD) whose membership is automatically updated based on user or device attributes, rather than being manually assigned.
About these practice questions
This MS-102 question is part of Courseiva's 712-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MS-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MS-102 exam.