Exam MS-102 topic 1 question 13 discussion

You can not assign Azure AD roles to dynamic groups. And you don't need a mailbox/sharepoint/etc, so it is not a 365 group.

The correct answer is C. a security group that has assigned membership. This type of group can be used to assign users and groups to an enterprise application and to a specific app role Option A. a Microsoft 365 group that has assigned membership is not correct because Microsoft 365 groups are not supported for app role assignment Option B. a Microsoft 365 group that has dynamic user membership is not correct because Microsoft 365 groups are not supported for app role assignment Option D. a security group that has dynamic user membership is not correct because security groups with dynamic membership are not supported for app role assignment

The answer is: C. a security group that has assigned membership. M365 and security groups can be assigned roles, but dynamic groups cannot. A security group is needed to govern access permission to the App1.

C. a security group that has assigned membership

I fully agree with C

C. a security group that has assigned membership

C is correct

Technically, option A could also work if it's a security-enabled M365 group, but the best answer would be C.

Answer is C. "a security group that has assigned membership" Azure AD roles can't be assigned to dynamic groups, they can only be assigned to users or non-dynamic (assigned) groups. Dynamic groups in Azure AD are primarily used for automatic membership management based on user attributes, but they don't extend to managing role assignments. For assigning Azure AD roles, we would typically use assigned groups or assign the roles directly to individual users.