Exam SC-300 topic 1 question 37 discussion

Adding a group to an administrative unit brings the group itself into the management scope of the administrative unit, but not the members of the group. In other words, an administrator scoped to the administrative unit can manage properties of the group, such as group name or membership, but they cannot manage properties of the users or devices within that group (unless those users and devices are separately added as members of the administrative unit). https://learn.microsoft.com/en-us/azure/active-directory/roles/administrative-units

D. Is the correct answer. The User administrative role assigned, will only grant permission to reset passwords for Directly assigned members to the AU. Members of Groups, which is assigned to the AU, is not affected by this. Tested this in Own Environment just to be sure :)

D. User2 and User3 only. When you add a group to an administrative unit, only the group itself is brought into the management scope of the administrative unit, not the individual members of the group

Funny, Co-pilot got this wrong until you copy community notes from here and ask, so is everyone wrong here? it then Agrees with D suddenly. Prior to that it answers A is correct. Here's what it originally output that is 'incorrect' - In Azure Active Directory (Azure AD), a User administrator assigned to an administrative unit (AU) can manage users within that AU. Given the details: AU1 includes Group1, User2, and User3. User5 is the User administrator for AU1. User5 can reset passwords for: User2 (direct member of AU1) User3 (direct member of AU1) User1 (indirect member via Group1, which is part of AU1) User5 cannot reset passwords for User4 and User5, as they are not part of AU1.

Respuesta correcta D

Assigning groups to an Administrative Unit only assigns/gives permissions to those groups, not to the members of those groups

Obvious, you cant change password of a group only users, duuuuh!

Why is User1 not included?

User2 and User3 only

D is the correct answer: the admin role only works on directly added members to the AU.

User2 and User3 only

D is correct

https://learn.microsoft.com/en-us/azure/active-directory/enterprise-users/groups-dynamic-membership#operator-precedence

can i say that AU is alos a Group and since addidng a group in to an existing group will not make the root users a set of the master group(nested group). and hence the user1 will n ot be added and the other users were directly added and so the admin can act on them