Exam AZ-104 topic 2 question 32 discussion

Correct Answer: Box 1:User1 and User3 only You must use Windows Server Active Directory to update the identity, contact info, or job info for users whose source of authority is Windows Server Active Directory. Box 2: User1, User2, and User3 Usage location is an Azure property that can only be modified from Azure AD (for all users including Windows Server AD users synced via Azure AD Connect).

I've checked on my AAD, answer is correct

JobTitle: User1 and User3 only UsageLocation: User1 and User3 only User1 and User3 are fully managed in Azure AD, so their attributes can be changed directly. User2 is synchronized from on-premises Active Directory, so the attributes must be modified on-premises and synced to Azure AD. 1. User1 (Cloud-Only in Entra ID) ✅ JobTitle: Can be modified directly in Entra ID via GUI or Microsoft Graph API. UsageLocation: Can also be modified in Entra ID. Why? User1 is a native Entra ID user with no dependency on an on-premises directory. 2. User2 (On-Prem AD Sync via Entra Connect) ❌ JobTitle: Cannot be modified in Entra ID because it is synced from on-prem Active Directory. UsageLocation: Cannot be modified in Entra ID for the same reason. Why? On-prem users are read-only in Entra ID. Changes must be made on-premises in Active Directory and synced via Entra Connect. 3. User3 (Guest from Microsoft Account) ✅ JobTitle: Can be modified directly in Entra ID. UsageLocation: Can be modified directly in Entra ID. Why? Guest users exist in Entra ID as separate objects and can have certain attributes modified, unlike on-prem synced users.

For users whose source of authority is Windows Server Active Directory, you must use Windows Server Active Directory to update their identity, contact info, or job info. After making updates, you must wait for the next synchronization cycle to complete before the changes take effect. However, you can update their attributes directly in the Microsoft Entra admin center if you are updating Microsoft Entra ID attributes, such as Usage Location.

This is why I hate AZ-104 questions. Microsoft needs to audit these answers. The correct answers are User1 only for both JobTitle and UsageLocation. For example, The correct answer for modifying the JobTitle attribute from Azure AD is User1 only. This is because User2 and User3 have their attributes sourced from different places: User2 from Windows Server Active Directory and User3 from a Microsoft account. Only User1’s attributes can be directly modified in Azure AD. Therefore, the answer is not User1 and User3 only; it is User1 only.

Box 2's answer is User2 only. User1 and User3 are guests and cannot modify their UsageLocation attribute from Azure AD. Only User2 is a member with on-premises sync enabled, which allows them to change their UsageLocation attribute from Azure AD. the reference you provided is not correct for this scenario. The reference above explains how to modify the UsageLocation attribute for a user from the Azure portal, but it does not mention anything about the UserType or the On-premises sync status of the user. These factors affect whether you can modify the attribute from Azure AD or not.

Correct

I spent two months in on-line courses including Microsoft Az-104 training. Most of the questions I see here are not at all covered in those trainings.

User1 and User3 only User1, User2, and User3 "You must use Windows Server Active Directory to update the identity, contact info, or job info for users whose source of authority is Windows Server Active Directory. After you complete your update, you must wait for the next synchronization cycle to complete before you'll see the changes." https://learn.microsoft.com/en-us/azure/active-directory/fundamentals/how-to-manage-user-profile-info#profile-categories

I dont know why you guys are vouching for User1 and User3 only, question is asking for For which users can you modify the attributes from Azure AD? and the reason they are giving You must use Windows Server Active Directory, this is not what the question is asking.. i will go with User 1 only

I got a modified form of this question on the March 2023 exam, specifically instead of indicating the "source" in the last column, the chart simply specified that User 2 was synced to on-premises and User 1 and 3 were not.

On-premises: Accounts synced from Windows Server Active Directory include other values not applicable to Azure AD accounts. Note You must use Windows Server Active Directory to update the identity, contact info, or job info for users whose source of authority is Windows Server Active Directory. After you complete your update, you must wait for the next synchronization cycle to complete before you'll see the changes.

Correct Answer. Tested in Lab Box 1: User1 and User3 Box 3 : User1,User2 and User3

JobTitle = User1 and User3 only UsageLocation = User1, User2 and User3

Correct Answer: Box 1:User1 and User3 only You must use Windows Server Active Directory to update the identity, contact info, or job info for users whose source of authority is Windows Server Active Directory. Box 2: User1, User2, and User3 Usage location is an Azure property that can only be modified from Azure AD (for all users including Windows Server AD users synced via Azure AD Connect). Reference: https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/active-directory-users-profile-azure-portal

WHY on earth should I know this to pass this exam? This detail is soo unimportant. Whether you know it or not does not tell anything about your qualification. Yet too many questions are like this...

Any user account sourced from on-prem AD CANNOT have ANY attribute changed in Azure AD. This is simply because of the "source of truth" rule with any form of identity in sync - there must be only one source of truth otherwise data gets dirty. In this case it is on-prem AD. My other point is that I do think you can say that the guest account can have their attributes updated either; technically you can, but since they feel the need to tell you it is a guest account, it is implied that is in another tenant, so you won't access to update it. This is poorly worded question with some key info missing making it difficult to conclude in the guest user can be edited or not. It does say "YOU" want to edit, but it does not say if you have admin rights of the other tenant where the guest account resides. So...poor question