Exam AZ-500 topic 4 question 86 discussion

Which Portal: Azure AD and M365 Admin Center Group type: Security or M365 only

Test in Lab Just an update Azure AD admin center now it's called Microsoft Entra Admin Center Which Portal: Azure AD and M365 Admin Center works (both tested) Group type: Security or M365 only (both tested).

Security or Microsoft 365 groups are role assignable https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/groups-concept

just MS Entra admin center portal and security or mail-enabled group. MS 365 groups are not role-assignable

Why no one does not talk about mail-enabled security groups? They are also role assignable as well. I answered this question for me as following: In this question there is some key point that we need to know and maybe we will see in the exam or real-life cases. Here are the notes for these questions. 1.We can assign Roles to the Microsoft 365 groups as well as Security Groups. 2.Mail enabled security groups are the groups which can be used for access management purposes (as security group) and for group communication (which allows groups for communication as Microsoft 365 group). We can assign roles to mail enabled security groups as well. Here we should keep in mind that Role assignable groups does not support group nesting (there is some questions in the bank -writing this for remembering as a note).

we can create a security group with azure ad assignable role also from M365 admiin center

The question talks about ASSIGNING. You can only assign the SECURITY or M365 Group type from the Azure AD Admin Console.

There is a catch for Role Assignment in the M365 admin center. You can create M365 groups AND enable Role Assignment ONLY if you uncheck the 'Add MS Teams to you group' checkbox. It's a stupid thing to have checkboxes when two options are mutually exclusive. You also need to make the Privacy of the group to 'Private'not Public otherwise your Role Assignment option gets greyed out. Which Portal: Azure AD and M365 Admin Center works (both tested) Group type: Security or M365 only (both tested).

login to M365 admin center, create a new group, during the process you are asked if you would like to "enable AD role assignment". So first answer should be both

Maybe I'm missing something, but I disagree with the first question. You can create the group using the M365 admin center to create the group. Yes you will then need to assign the role using the Azure AD admin center, but the group can be created in M365 portal (tested it myself).

answer is correct you can not set the "isAssignabletToRole" option from the M365 portal and you can only apply it to "Security or Microsoft 365 group" https://learn.microsoft.com/en-us/azure/active-directory/roles/groups-concept