Microsoft AZ-104 Exam Dumps, Practice Test Questions

Azure RBAC determines access to Azure resources, not which directory is authoritative for synchronized phone attributes. Granting a privileged role would add risk without repairing attribute flow.

Licensing controls entitlement to services, not the source of the synchronized user profile value. Reassignment would not correct the phone attribute and could interrupt licensed workloads.

Cloud-only edits to source-managed identity attributes may be unavailable or overwritten by the next sync. The durable change belongs in the authoritative directory, not merely the cloud projection.

PATCH can update writable scalar user attributes such as department and displayName. However, the reporting application reads the directory manager navigation relationship, not the spelling of those profile values. Editing only the employee's text fields leaves the old supervisor referenced and does not correct the directReports relationship.

Microsoft Graph exposes a manager's directReports relationship for reading, but Microsoft's documentation explicitly says that direct reports aren't assigned through that collection. Instead, the administrator sets the employee's manager/$ref. Posting to a nonexistent writable directReports collection won't change the authoritative reporting relationship.

A security group can control application or resource authorization and can be named for a reporting team. Its membership is distinct from the manager navigation relationship, which the application explicitly queries. The app would still resolve the former manager until the employee's manager reference is updated.

A UPN is an authentication identifier and need not represent every email alias. Replacing it would change the sign-in experience even though the requested outcome is mail delivery to an additional address.

The Entra mailNickname value is not a substitute for the mailbox proxyAddresses collection managed through the applicable mail system. Changing it alone does not add a receive address to the existing mailbox while leaving the UPN intact.

Application identifier URIs are used by application registrations, not Exchange recipient email delivery. The alternate receiving address must be configured on the mailbox, not as an application identity name.

Assigned membership is a legitimate choice when a group owner must explicitly approve each person, but it does not evaluate HR attribute changes. An administrator would still have to add or remove each person after a department change, defeating the requirement for automatic membership reconciliation.

A dynamic device group evaluates device objects, not employee user accounts. A device operating-system or management attribute can support device-policy targeting, but it cannot establish which enabled people belong to the Engineering staff group. It also does not substitute for supported user.department and user.accountEnabled predicates.

Periodic access reviews can identify stale assigned members, but they do not continuously apply the eligibility condition when HR changes the department. The scenario calls for attribute-driven updates in ordinary operations rather than a human review or batch maintenance cycle.

Dynamic device membership evaluates computer object properties, such as operating-system values. It neither produces a roster of individually approved people nor leaves the membership solely under an administrator’s explicit decisions. A device-targeted policy group could use this feature, but not the requested personnel approval workflow.

Dynamic user groups evaluate rule matches automatically; a group owner does not approve each computed match before membership is applied. The requirement demands explicit administrator selection independent of directory attributes, so use Assigned membership instead.

A department-filtered dynamic user group would admit any user satisfying the selected attribute, including people nobody individually approved. This is useful when HR attributes alone are the intended eligibility authority, but it conflicts with the explicit person-by-person administrator decision required here.

In a dynamic membership expression, logical AND is evaluated before OR unless parentheses change the grouping. This expression therefore includes everyone in Payroll, regardless of accountEnabled, and evaluates the enabled condition only for Treasury. It preserves the reported gap instead of applying the enabled check to both departments.

A single-valued Department attribute cannot simultaneously equal Payroll and Treasury for the same user. Requiring both equalities with AND makes the rule effectively unsatisfiable, even for enabled staff who should be included. It is not a tighter way to express membership in either department.

OR-ing the enabled check means nearly every enabled user can satisfy the rule without working in either approved department, and any Payroll or Treasury user is included even if disabled. The expression widens membership instead of imposing a mandatory eligibility constraint.

An assigned device group can be managed explicitly, but it does not automatically evaluate a device owner’s department for membership. Switching from a dynamic group to assigned membership therefore removes the automation requirement rather than correcting unsupported rule syntax. Enrollment workflows would need separate explicit group updates.

Microsoft Entra dynamic device membership does not support a cross-object expression that traverses the registered owner and reads that user’s department. Such a property path is outside the supported device rule attribute list, so it cannot create the intended result even if the owner’s department is populated correctly.

A dynamic user group evaluates user accounts, not device objects. Assigning a device-targeted configuration to a user group might be possible for particular management workloads, but it does not produce the required dynamic security group of Windows device objects or resolve the unsupported device membership expression.

An access review can help identify unexpected members afterward, but it does not close the entry path when a user can modify the attribute that instantly qualifies them. For a privileged application the controlling issue is who can alter the rule inputs, not just whether membership is periodically inspected.

Membership rule processing intervals do not establish authorization integrity. Faster re-evaluation would actually make a self-edited qualifying attribute grant group membership sooner. There is no supported five-minute setting that substitutes for protecting the authoritative source of an access-driving property.

Azure RBAC assignment permissions protect management-plane role grants; the scenario’s application is granting access based on Entra group membership. A user who can modify the dynamic-rule attribute can still influence that group even if they cannot assign an Azure subscription role.

A Dynamic user rule evaluates people, not the required device population. Switching the membership type would change the target object type and would not resume the stopped rule process. The configured device rule already matches its device, making this a processing-state problem rather than a user eligibility problem.

Recreating a device can disrupt enrollment, device identity and policy targeting while leaving the group’s paused update state unchanged. Even a fresh qualifying device will not be added while membership processing is administratively suspended. Examine the documented status and resume it first.

Device ownership is not an arbitrary string location for an employee’s department. Mutating it to unrelated metadata does not resume dynamic group processing and can break legitimate corporate/personal device selection. The observed Update paused status is the decisive clue.

Microsoft 365 groups have a user-oriented collaboration purpose and cannot solve a mixed user-and-device dynamic membership requirement. Changing the label of the group would not make one dynamic rule evaluate both kinds of objects, and it could disrupt use of the group by device-targeting workloads.

Dynamic device group rules use supported device attributes, not the department field reached through a registered owner user. Even a valid Windows device rule would only include devices, not the employee accounts associated with them. It is not a legal mixed-object membership expression.

A dynamic user group does not allow administrators to insert arbitrary device members manually as exceptions to its rule. Dynamic membership is recalculated automatically for its supported object type, and manual additions are disallowed. The request needs a design split rather than exception IDs.

Deleting and recreating a group produces a different directory object identifier even if the display name is reused. An application bound to the old immutable object ID would not silently follow the replacement. This can break authorization until references are updated and the new group is reviewed.

Changing from a security group to a Microsoft 365 collaboration group is not the required membership-type conversion. The proposed nesting also changes object relationships and is not a supported shortcut to preserve the old application security group identifier and its intended access controls.

A new group with the same display name still receives a new object ID, so the existing application mapping would not recognize it automatically. Duplicating names can make administration confusing and does not guarantee the same authorization result. The scenario expressly requires avoiding app-reference edits.