Exam MS-102 topic 1 question 116 discussion

In a test tenant, I was able to add mail-enabled security, M365 and security groups to an EndPoint Security Manager role assignment. Add Role Assignment -> Admin Groups...

Checked : From endopint manager > tenant admin > roles > open "endpoint decurity manager" > assignments > ..... you can choose M365, security & mail-enabled group

As of May 2025, C (mail-enabled security and security only) is the correct answer. I tested it in my Dev-Tenant

The correct answer is B. Security only. Explanation: - The Endpoint Security Manager role is managed through role-based access control (RBAC) in Microsoft Intune. - Security groups are the only group type that can be used for assigning RBAC roles in Microsoft Endpoint Manager. - Mail-enabled security groups, Microsoft 365 groups, and distribution groups cannot be used for RBAC role assignments in Endpoint security.

To assign roles (like Endpoint Security Manager) in Microsoft Entra ID (formerly Azure AD), you can only use security groups — and not mail-enabled or Microsoft 365 groups. Security groups are used to control access and assign roles/permissions. Role assignments (like Azure AD roles or Microsoft 365 admin roles) can only be assigned to users or security groups.

There are no right answers. Only Security groups and M365 groups can have assigned roles. You can't create a mail-enabled security group in Entra ID. So right answer is F: Security and Microsoft 365 groups.

Microsoft 365 groups cannot be used for role assignments, so including them in this answer is incorrect.

The correct option is D, because it is the only answer that contains both groups to which roles can be assigned: To assign a role to a group, you must create a new security or Microsoft 365 group with the isAssignableToRole property set to true https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/groups-concept

copilot and Chatgpt choose security only because you can't use Microsoft 365 and mail-enabled security for role assignment!

You CAN use : D. mail-enabled security, Microsoft 365, and security only But recommended would be : B. security only. But question here is about what you CAN do.

D https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/groups-concept

dovrebbe essere la B https://learn.microsoft.com/it-it/microsoft-365/admin/create-groups/compare-groups?view=o365-worldwide

Correct answer is C for me - Mail Enabled Security and Security Group types can both be used for delegation here.

I tested in my tenant from Intune to assign this role, I was able only to choose: mail-enabled security and security only. When I tried MS365 or Distribution group, there is not any option to choose. So, I will choose option C.

Looks like B for me -> https://learn.microsoft.com/en-us/azure/active-directory/roles/groups-concept#how-role-assignments-to-groups-work

https://www.examtopics.com/discussions/microsoft/view/80188-exam-ms-100-topic-5-question-64-discussion/

To create a group and assign the Endpoint Security Manager role to the group, you can use a role-assignable group. A role-assignable group is a type of Azure AD security group that can be assigned to a role in Microsoft Endpoint Manager1. You can create a role-assignable group by using the Azure portal, PowerShell, or Microsoft Graph2.