Users and groups in Azure - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

Understanding Azure AD Group Types

Which of the following best describes the difference between an Azure AD Security Group and an Office 365 Group?

A Both Security Groups and Office 365 Groups serve the exact same purpose and can be used interchangeably.

B Security Groups provide collaboration features like shared mailboxes, while Office 365 Groups are only for access control.

C Security Groups are used for managing member access to resources, while Office 365 Groups provide collaboration features like shared mailboxes and calendars.

D Security Groups are only for external users, while Office 365 Groups are only for internal users.

💡 Hint

Think about what collaboration tools Office 365 Groups offer compared to Security Groups.

Security Groups are primarily for access management to resources. Office 365 Groups include collaboration tools like shared mailboxes, calendars, and files.

❓ Configuration

intermediate

Assigning a User to an Azure AD Group via Azure CLI

You want to add a user with object ID 1234-5678-9012 to a group with object ID abcd-efgh-ijkl using Azure CLI. Which command will do this correctly?

A az ad user add --user 1234-5678-9012 --group abcd-efgh-ijkl

B az ad group member add --group abcd-efgh-ijkl --member-id 1234-5678-9012

C az group member add --group abcd-efgh-ijkl --member 1234-5678-9012

D az ad group add-member --group abcd-efgh-ijkl --member-id 1234-5678-9012

💡 Hint

Check the Azure CLI command syntax for adding members to groups.

The correct Azure CLI command to add a member to an Azure AD group is az ad group add-member with the --group and --member-id parameters.

❓ Architecture

advanced

Designing Group-Based Access for Multiple Applications

You manage multiple applications in Azure that require different access levels. You want to use Azure AD groups to simplify access management. Which design approach is best?

A Create separate Azure AD groups for each application and assign users accordingly; assign these groups to application roles.

B Create one large Azure AD group for all users and assign it to all applications with all roles.

C Assign users directly to each application without using groups to keep it simple.

D Use dynamic groups that include all users regardless of application needs.

💡 Hint

Think about how to manage access efficiently and securely for multiple apps.

Creating separate groups per application allows precise access control and easier management. Assigning groups to application roles follows best practices.

❓ security

advanced

Preventing Privilege Escalation with Group Membership

Which Azure AD group membership practice helps prevent accidental privilege escalation?

A Use nested groups sparingly and audit group memberships regularly.

B Allow users to add themselves to any group to speed up access.

C Assign all users to the Global Administrator group for simplicity.

D Disable group membership auditing to reduce alert noise.

💡 Hint

Consider how group nesting and auditing affect security.

Nested groups can hide permissions, so use them carefully. Regular audits help detect unwanted access and prevent privilege escalation.

❓ service_behavior

expert

Effect of Group Membership Changes on Access Tokens

After adding a user to a new Azure AD group that grants access to a resource, when will the user’s access token reflect this new group membership?

A Immediately, without any user action, due to real-time token updates.

B Only after the user signs out and signs back in to get a new token.

C After 24 hours automatically, regardless of sign-in activity.

D Only after the administrator manually refreshes the token.

💡 Hint

Think about how tokens are issued and refreshed in Azure AD.

Access tokens are issued at sign-in and do not update dynamically. The user must sign out and sign back in to receive a token with updated group claims.