Cloud · Microsoft Azure · Certifications
AZ-500: Include dynamic users and devices in one access group
Select one answer. Your result and the explanation will appear immediately.
Question 14
You are configuring access control for a critical application in Azure AD. Group1 must include both dynamically selected users and devices based on specific attributes, but its current configuration does not support this requirement. Which action should you take to meet the identity and access requirements for Group1?
Correct answer: Change the membership type of Group1 to Assigned, create two separate dynamic groups (one for users and one for devices), and add these groups as members to Group1.
A dynamic Microsoft Entra group can have a membership rule for either users or devices, but not both in the same group. Use separate dynamic security groups for the user and device rules, then use an assigned security group as the access-control parent and add the dynamic groups to it.
Exam clue: The requirement explicitly combines dynamically selected users and devices. This is not supported by one dynamic membership rule.
Remember: Dynamic group rule: users OR devices, not users AND devices. Use separate dynamic groups and an assigned parent group when an application must target both.