Question
You have an on-premises Active Directory Domain Services (AD DS) domain that syncs with an Azure Active Directory (Azure AD) tenant. Group writeback is enabled in Azure AD Connect.
The AD DS domain contains a server named Server1. Server1 contains a shared folder named share1.
You have an Azure Storage account named storage2 that uses Azure AD-based access control. The storage2 account contains a share named share2.
You need to create a security group that meets the following requirements:
✑ Can contain users from the AD DS domain
✑ Can be used to authorize user access to share1 and share2
What should you do?
- A. In the Azure AD tenant, create a security group that has assigned membership.
- B. In the AD DS domain, create a universal security group. Correct
- C. In the Azure AD tenant, create a security group that has dynamic membership.
- D. In the Azure AD tenant, create a Microsoft 365 group.
Explanation
A universal security group created in the AD DS domain can contain users from the AD DS domain and can be used in NTFS/share permissions on share1. Azure AD Connect synchronizes the on-premises group to Azure AD, so the same group can be assigned share-level permissions (Azure RBAC) on share2 in storage2, which uses identity-based access with hybrid identities. Groups created in the Azure AD tenant (assigned, dynamic, or Microsoft 365) do not exist in AD DS by default and cannot be used to authorize access to share1; group writeback only writes cloud groups back to AD DS and is not needed for this solution.
