A port authority is selecting the right security object for a small Copilot pilot cohort that will change membership over the next quarter. Which choice is most appropriate?

A security group representing the Copilot pilot cohort lets a port authority update membership cleanly over the quarter while policies and assignments stay pointed at the group. Changing harbor staff in and out of the pilot becomes a membership operation on a durable security object rather than rewriting credentials, roles, or one-off grants each time the roster shifts.

A direct user entry representing the pilot cohort so membership can be updated cleanly fails because a single user object cannot represent a changing cohort — every assignment would have to be managed user by user whenever membership changes, instead of updating membership in one place. An administrative unit representing the pilot cohort so membership can be updated cleanly fails because an administrative unit scopes who can manage objects administratively, not who is a member of the pilot cohort — it does not give Conditional Access or Copilot licensing a group of pilot users to point at. A distribution list representing the pilot cohort so membership can be updated cleanly fails because a distribution list is a mail-routing object for sending messages to current members, not a security principal that Conditional Access or license assignment can evaluate to determine pilot access.

Exam caveat: The fundamentals skill is choosing security groups appropriately as the object for changing pilots, not administrative units, which delegate management rather than membership, or distribution lists, which route mail rather than represent access. Keep pilot users as individual Entra identities nested in the cohort group.

Operational check: Create the pilot security group, nest only approved harbor identities, point Copilot-related assignments at the group, rotate membership mid-quarter without pointing assignments at an administrative unit or a distribution list, and confirm Conditional Access policies reference the group rather than direct user entries.