Exam PL-600 topic 7 question 6 discussion

Actual exam question from Microsoft's PL-600

Question #: 6
Topic #: 7

DRAG DROP -
You need to recommend methods for assigning security to each group of users.
What should you recommend? To answer, drag the appropriate methods to the correct groups of users. Each method may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.
NOTE: Each correct selection is worth one point.
Select and Place:

Show Suggested Answer

Suggested Answer:

Box 1: Power Platform Local Business Owner Team
Owner team: An owner team owns records and has security roles assigned to the team. A user's privileges can come from their individual security roles, those of the teams that they're part of or the ones they inherit. A team has full access rights on the records that the team owns. Team members are added manually to the owner team.
Scenario: Employee authentication with the existing system is provided by an on-premises Active Directory instance that is linked to Azure Active Directory.
Box 2: Azure Active Directory Security Group Team
An Azure Active Directory (Azure AD) group team. Similar to owner team, an Azure AD group team can own records and can have security roles assigned to the team.
Note: The administration of app and data access for Microsoft Dataverse has been extended to allow administrators to use their organization's Azure Active
Directory (Azure AD) groups to manage access rights for licensed Dataverse users.
Box 3: Azure Active Directory B2B Guest Access
An Azure AD B2B collaboration user is an external user, typically from a partner organization, that you invite to sign into your Azure AD organization using their own credentials. This B2B collaboration user (also generally referred to as a guest user) can then access the apps and resources you want to share with them. A user object is created for the B2B collaboration user in the same directory as your employees. B2B collaboration user objects have limited privileges in your directory by default, and they can be managed like employees, added to groups, and so on.
Scenario: Before First Up signs a contract to place workers at a client company, a member of the audit team visits the company and interviews company management. Audit members use different types of devices including Android and iOS devices. First Up has no plans to require the use of a single type of device.
Reference:
https://docs.microsoft.com/en-us/power-platform/admin/manage-group-teams https://docs.microsoft.com/en-us/azure/active-directory/external-identities/user-properties

by kenwj2342 at Nov. 24, 2021, 9:16 p.m.

Comments

Submit Cancel

kenwj2342

Highly Voted 3 years ago

Correct

upvoted 11 times

...

EuMesmo

Highly Voted 2 years, 11 months ago

Automation - Why not Dataverse Application User?

upvoted 9 times

dlnuser

1 year, 6 months ago

If automation includes Power Automate flows, an account is required to own the Power Automate licence, configure and use the flows. "Automation" is a pretty vague notion in this case, I would not recommend an app user unless we're sure it's what's required.

upvoted 1 times

...

Xeniya

2 years, 10 months ago

I guess because of: You can use server-to-server (S2S) authentication to securely and seamlessly communicate between Dataverse and your web applications and services. S2S authentication is the common way that apps registered on Microsoft AppSource use to access the Dataverse data of their subscribers. All operations performed by your application or service by using S2S will be performed as the application user you provide, rather than the user who's accessing your application. https://docs.microsoft.com/en-us/power-platform/admin/create-users#create-an-application-user https://docs.microsoft.com/en-us/power-platform/admin/system-application-users

upvoted 3 times

...

MrEz

Most Recent 8 months, 4 weeks ago

Azure Active Directory B2B Guest Access for corporate governance auditing team? Now I was wondering if the 'auditing team members' are internal or external people? in favour external people: - in many markets active - use individual mobile devices - audit people may intentionally have some independence to any of their 'clients' a too deep relationship may not been wished, neither to the employer nor to the customer. in favour internal: - special knowledge how to assess a potential customer company - the assessment could be delicate data information you don't want to share externally - GOVERNANCE as it explicitly says is maybe you want to have internal. (potentially the governance audit team is another team than the international auditing team member, the case study is not so clear here) my solution is: Governance is internal stuff. and maybe not even related to the international audit team members. therefore: B2B Guest Access is not an option as it is internal staff. 3 D: Azure Active Directory Security Group Team

upvoted 2 times

MrEz

8 months, 4 weeks ago

1) D: Azure Active Directory Security Group Team 2) A: Dataverse application user 3) D: Azure Active Directory Security Group Team Unused: Power Platform Local Business Onwer Team: too much privileges says gpt when asked specifically Azure Active Directory B2B Guest Access: none of the 3 group of users in this question is external to First Up Consulting. but: i am not a security nor license expert.

upvoted 1 times

...

ArezouDynamics

2 years, 2 months ago

For automation i'll go with app user.

upvoted 5 times

ArezouDynamics

2 years, 2 months ago

cause we shouldn't waste a license for the time that app users can be helpful.

upvoted 2 times

...

giogo

2 years, 9 months ago

correct

upvoted 1 times

...