Contoso wants all users whose Department attribute is set to 'Sales' in Microsoft Entra ID to be automatically added to a group called 'Sales Team'. The group should include a shared mailbox and a Microsoft Teams workspace, and membership should update automatically when the Department attribute changes. What should the admin create?
Select an answer to reveal the explanation.
Short Explanation
You need a Microsoft 365 group with dynamic membership, because it's the only group type that gives you the shared mailbox and Teams workspace together. Set the rule to user.department -eq 'Sales', and Entra ID adds or removes users automatically as the attribute changes.
Full Explanation
Microsoft 365 groups are the only group type that supports both a shared mailbox (Exchange) and a Teams team simultaneously. When you enable dynamic membership on a Microsoft 365 group with the rule (user.department -eq 'Sales'), Microsoft Entra ID continuously evaluates the rule and adds or removes members as their Department attribute changes. Teams teams can then be created on top of the Microsoft 365 group, inheriting the same membership. This fully satisfies all requirements: shared mailbox, Teams workspace, and automatic dynamic membership.
The dynamic security group approach with the same membership rule is incorrect because security groups — even dynamic ones — cannot back Teams teams or provide a shared mailbox. Teams teams require a Microsoft 365 group as their backing store, and you cannot add Teams teams to security groups.
The Microsoft Graph PowerShell nightly script approach is manual, error-prone, and can delay membership updates by up to 24 hours before membership reflects reality. Dynamic membership rules in Entra ID evaluate changes within minutes of the attribute changing. Scripted approaches are never preferable when a native dynamic membership feature exists.
The mail-enabled security group approach with dynamic membership and a Teams license is incorrect because mail-enabled security groups are a legacy Exchange group type that supports distribution list functionality but cannot back Microsoft Teams teams. Mail-enabled security groups do not support Teams workspace creation or the full Microsoft 365 group feature set (Planner, SharePoint site, shared mailbox).
Exam tip: Know the four group types in Microsoft 365: Security Group, Microsoft 365 Group, Distribution Group, and Mail-Enabled Security Group. Only Microsoft 365 Groups support Teams teams, SharePoint sites, and shared mailboxes. Dynamic membership is available for Security Groups and Microsoft 365 Groups (requires Microsoft Entra ID P1 or P2 licensing).