Describe the capabilities of Microsoft Entra →hardMultiple ChoiceObjective-mapped

SC-900 Describe the capabilities of Microsoft Entra Practice Question

Exhibit

Refer to the exhibit.

```powershell
Get-AzureADGroupMember -ObjectId "Sales_Group_ObjectID" | Select-Object DisplayName, UserPrincipalName
```

Refer to the exhibit. An administrator runs the PowerShell cmdlet shown. What is the purpose of this command?

⚠ Common exam trap

Candidates often confuse retrieving group members (Option D) with viewing dynamic membership rules (Option A), because both involve Azure AD groups, but the cmdlet names and parameters differ significantly.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

To display the display name and user principal name of members of the Sales group.

The PowerShell cmdlet `Get-AzureADGroupMember -ObjectId <SalesGroupObjectId>` retrieves the members of a specific Azure AD group. By default, it returns the members' display names and user principal names (UPNs), which are the primary identifiers for users in Microsoft Entra ID. Option D correctly identifies this purpose.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
To show the dynamic membership rules of the Sales group.
Why it's wrong here
The Get-AzureADGroupMember cmdlet is specifically designed to enumerate the individual user or service principal objects that are direct members of a specified Azure AD group. It does not provide information about the group's configuration, such as its dynamic membership rules. To view dynamic membership rules, one would typically use Get-AzureADGroup and inspect the MembershipRule property of the group object itself.
✗
To list all groups in the Sales department.
Why it's wrong here
This cmdlet is focused on retrieving the members of a single, specified Azure AD group, identified by its object ID. It is not designed to discover or list multiple groups, nor does it possess filtering capabilities to identify all groups associated with a particular department. To list groups based on departmental attributes, one would use Get-AzureADGroup with appropriate -Filter parameters.
✗
To list Azure AD roles assigned to the Sales group.
Why it's wrong here
The Get-AzureADGroupMember cmdlet exclusively returns user or service principal objects that are part of the group's membership. It does not provide details about Azure AD roles that might be assigned to the group itself, or roles assigned to individual members. Role assignments are managed through distinct cmdlets like Get-AzureADDirectoryRole or Get-AzureADMSPrivilegedRoleAssignment, which query role-specific data rather than group membership.
✓
To display the display name and user principal name of members of the Sales group.
Why this is correct
The command Get-AzureADGroupMember successfully retrieves all direct members of the Azure AD group specified by its object ID. Piping this output to Select-Object DisplayName, UserPrincipalName then precisely extracts and displays only the user's friendly name and their unique sign-in identifier. This combination accurately fulfills the objective of reporting specific identity attributes for each member of the Sales group.

Go deeper

SC-900 Describe the capabilities of Microsoft Entra Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question