Manage Microsoft Entra users and groups
Objective entra.users-groups sits in Manage Azure identities and governance, which carries 24% of the Azure Administrator exam. The questions below are original, written from the official objective title above, and each explanation cites the Microsoft Azure page it rests on.
Objective title verbatim from the official objectives. Microsoft Azure exam page ↗
A worked example
Shown solved, with the whole explanation open: this is what every question here carries.
A directory administrator wants new employees to automatically receive group memberships and license assignments on hire, and have those assignments removed automatically when they leave. Which Microsoft Entra product provides this?
The concept
Microsoft Entra is a family of products, each solving a different problem. Automating what an account receives on hire and loses on exit is lifecycle work. Risk detection, legacy protocol support, and non-human identities are three separate problems with three separate products.
Why this answer
ID Governance is described as automatically assigning user accounts, groups, and licenses to new employees and removing those assignments when employees leave the company, matching the scenario exactly.
- Correct: this product automates onboarding and offboarding assignments including groups and licenses.
- BID Protection detects and remediates sign-in and user risk, it does not manage onboarding or offboarding assignments.
- CDomain Services provides legacy Kerberos/LDAP authentication for cloud apps, unrelated to lifecycle automation.
- DWorkload ID manages identities for applications, services, and containers, not employee lifecycle assignments.
Now you: objective entra.users-groups questions
No account needed. The explanation opens when you answer.
Sample question 1 of 3
A user account is added to GroupA. GroupA is itself added as a member of GroupB, and GroupB has been assigned the Contributor role on a resource group. What access does the user have to that resource group?
Sample question 2 of 3
A user belongs to GroupA, nested inside GroupB. GroupB is assigned Contributor on a subscription. The same user is also directly assigned Reader on one resource group inside that subscription. What is the user's effective permission on that resource group?
Sample question 3 of 3
An administrator at a company wants to script new-hire onboarding, automatically creating user accounts and assigning licenses without using the Microsoft Entra admin center. Which tool should the administrator use?
Full Azure Administrator question bank coming
We’re writing the complete bank from the official objectives right now. Leave your email and we’ll tell you when it ships, nothing else, ever.
Read the sources
These are the official pages the questions above cite. Reading them is studying the objective from the primary source, which is what the explanations point you toward anyway.