SC-900 Describe the capabilities of Microsoft Entra Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Create an administrative unit for the finance department.

  Why it's wrong here

  Creating an administrative unit (AU) allows for the delegation of administrative permissions over a specific subset of Microsoft Entra ID objects, such as users, groups, or devices. While an AU can contain users from the finance department, its primary function is to scope administrative roles, enabling a limited administrator to manage only those specific users or groups. It does not provide a mechanism to automatically add or remove users from a security group based on their 'department' attribute. Therefore, an AU does not address the requirement for dynamic group membership.

• ✓

  Create a dynamic group with rule: user.department -eq "Finance".

  Why this is correct

  Creating a dynamic group with the rule user.department -eq "Finance" directly fulfills the requirement for automatic group membership. Microsoft Entra ID dynamic groups continuously evaluate user attributes against defined rules, automatically adding users whose 'department' attribute matches "Finance" and removing those who no longer meet the criteria. This ensures that the group membership remains accurate and up-to-date without manual intervention, significantly reducing administrative overhead. This feature requires a Microsoft Entra ID P1 or P2 license.

• ✗

  Enable self-service group management.

  Why it's wrong here

  Enabling self-service group management allows end-users to create new groups, request to join existing groups, or manage membership of groups they own, without direct administrator involvement. While it empowers users and can reduce help desk tickets for basic group management, it does not provide any functionality for automatically assigning users to a group based on a predefined attribute like their department. Users would still need to manually join or be added to the finance department group.

• ✗

  Configure entitlement management with an access package for the finance application.

  Why it's wrong here

  Configuring entitlement management with an access package is designed to govern access to resources for internal and external users through a structured approval workflow. An access package bundles resources like applications, SharePoint sites, and security groups, allowing users to request access to the entire package. However, entitlement management does not dynamically populate a security group based on user attributes such as their department; it manages the assignment of users to resources, including groups, after a request and approval process.

Go deeper

Related to this question