Microsoft Certified: Identity and Access Administrator Associate Practice Mode

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• Chose D1

  Entra role assignable forces Assigned membership. Choosing Dynamic group membership to assign a role to a user goes against the core principal of Entra. I tested this in my lab for Validation. The answer is def "D"

• Chose D2

  You can assign the Contributor role for RG1 to User1, VM1, and App1 because they are all security principals (User account, system-assigned managed identity, and service principal) that Azure Role-Based Access Control (RBAC) can assign roles to. Group1 is a dynamic group, which is not supported for role assignments in RBAC, making it ineligible

• Chose D2

  To determine which identities can be assigned the Contributor role for Resource Group RG1, we need to understand which types of identities are eligible for Azure role-based access control (RBAC) assignments. ✅ Eligible identities for RBAC role assignments: Users – e.g., User1 Groups – e.g., Group1 Managed identities for Azure resources – e.g., VM1 (if it has a system-assigned or user-assigned managed identity) Service principals / Enterprise applications – e.g., App1 🔍 Contributor Role: The Contributor role allows full management of Azure resources, excluding access management. ✅ Correct Answer: E. User1, Group1, VM1, and App1 All four types of identities can be assigned the Contributor role at the resource group level. Would you like help assigning the Contributor role to one of these identities using the Azure portal or PowerShell?