A county IT shared-services team prefers scalable Conditional Access and license-related targeting for a Copilot pilot instead of endless one-off user exceptions. What should they choose?
Select an answer to reveal the explanation.
Short Explanation
One-off exceptions multiply like sticky notes on a county admin's monitor. Put the Copilot pilot people in a group and manage the group—that is the grown-up security object. You'll find a mail recipient object isn't a security principal you can target, a delegation boundary won't give you Conditional Access control, and a device query result won't capture your user pilot.
Full Explanation
Group-based assignment uses security groups as manageable objects for targeting Conditional Access and related license or access decisions. For a county IT shared-services Copilot pilot, managing the pilot cohort as a security object scales far better than endless one-off user exceptions. Policies and entitlements point at the group; membership changes update who is in the pilot without rewriting every exception.
Administrative unit use so the pilot cohort is managed as a delegation boundary rather than many one-off user exceptions fails by concept because administrative units delegate administrative scope rather than serve as a security object that Conditional Access and license-related targeting can use, so they do not eliminate one-off user exceptions. Distribution list use so the pilot cohort is managed as a mail recipient object rather than many one-off user exceptions fails because classic distribution lists are not security principals that Conditional Access or licensing can target, even though they are a real and useful object for communication. Dynamic device grouping so the pilot cohort is managed as a device query result rather than many one-off user exceptions fails here because device queries target devices, not the user cohort in the Copilot pilot, so membership would not reflect who is actually in the Copilot pilot.
Exam caveat: AB-900 expects recognition of users versus groups as security objects and when groups are the better choice for pilots. You need not design full Copilot licensing automation on the exam item. Administrative unit delegation boundaries, mail recipient objects, and device query results remain the wrong objects for employee pilots.
Operational check: Create a Copilot pilot security group, assign Conditional Access and license-related targeting to the group, add and remove pilot users via membership only, and confirm one-off per-user CA exceptions are not multiplying. Reject administrative unit delegation boundaries, mail recipient objects, and device query results as cohort management strategies.
Prefer to study offline? Printable PDF study book + test engine ($7.50, unofficial). These questions stay free here.