Exam MD-100 topic 5 question 28 discussion

1.Yes https://docs.microsoft.com/en-us/azure/active-directory/devices/assign-local-admin By default, Azure AD adds the user performing the Azure AD join to the local administrator group on the device. User1 joins Computer1 to Azure AD by using [email protected]. 2. No https://docs.microsoft.com/en-us/azure/active-directory/roles/permissions-reference 3.No https://docs.microsoft.com/en-us/azure/active-directory/roles/permissions-reference

1. NO - domain [email protected] has no admin access (no role assigned) - only the local User1 account 2. YES - https://docs.microsoft.com/en-us/azure/security-center/security-center-permissions 3. NO - https://docs.microsoft.com/en-us/azure/active-directory/roles/permissions-reference#cloud-device-administrator-permissions

Understand role as a group in Azure AD. In Azure Active Directory (Azure AD), if another administrator or non-administrator needs to manage Azure AD resources, you assign them an Azure AD role that provides the permissions they need. Any of these three roles are able to become a local administrator account: The Azure AD Global Administrator role The Azure AD joined device local administrator role - especially this role is responsible for making a regular user (User1) a local administrator. The user performing the Azure AD join The process is very simple, The role Azure AD joined device local administrator is a role added to the Local Administrators group, so they become local administrators. First statement is a YES.

admin2 is member of the power users so he can install software change the time zone and power settings and install active x controls

Cloud Device Administrator Users in this role can enable, disable, and delete devices in Azure AD and read Windows 10 BitLocker keys (if present) in the Azure portal. The role does not grant permissions to manage any other properties on the device. therefor yes no no

Yes, NO, NO, please refer the roles from below link:　https://docs.microsoft.com/en-us/azure/active-directory/roles/permissions-reference

If computer1 is joined to Azure Ad , why is the securrity admi cannot install firewall, since computer1 is joined to the Ad. question 2 need to be yes.

The Correct answer is Yes, No, No. Cloud Device Administrator can enable, disable, and delete devices in Azure AD and read Windows 10 BitLocker keys (if present) in the Azure portal. The role does not grant permissions to manage any other properties on the device.

Is local user and ad users are going to merge after join?

YES NO N0

I pass the exam today, In the table it was UserA instead User1 as is shown here, so i choose No

Yes No No

This is a better link giving you the exact role titles and descriptions, which seems to indicate that Cloud Device Administrator cannot install software, which would make this a Yes, No, No answer. https://docs.microsoft.com/en-us/azure/active-directory/roles/permissions-reference

The above is the Azure role for the Security administrator

View and update permissions for Security Center. Same permissions as the Security Reader role and can also update the security policy and dismiss alerts and recommendations.

Ref : https://docs.microsoft.com/en-us/azure/role-based-access-control/built-in-roles