Exam MS-100 topic 3 question 77 discussion

This should be A. Disabled users are synced by default.

Disabled accounts are synchronized as well to Azure AD. Disabled accounts are common to represent resources in Exchange, for example conference rooms. The exception is users with a linked mailbox; as previously mentioned, these will never provision an account to Azure AD. The assumption is that if a disabled user account is found, then we will not find another active account later and the object is provisioned to Azure AD with the userPrincipalName and sourceAnchor found. In case another active account will join to the same metaverse object, then its userPrincipalName and sourceAnchor will be used. https://docs.microsoft.com/en-us/azure/active-directory/hybrid/concept-azure-ad-connect-sync-user-and-contacts

Global Security Groups do not sync

A is correct

All sync.

All Sync

Disabled accounts do sync Groups would not sync unless it's mail enabled

Global security group - YES - tested Enabled User - YES Disabled User (such as SHARED MAILBOX) - YES YES YES

A. Disabled users and global groups are synced.

It is A, AADC does not sync built in security groups but this group is not a built in security group, it has been created

C. Disabled users ARE synced, global security groups are NOT.

The answer should be A as although in-built security groups are not synchronised a global security group is merely a type of security group and as such could be an additional group create by the organisation which would synchronise via AD Connect. Both users sync to AzureAD since it does not matter if they are disabled or enabled, the user and their status will synchronise across

C, sec groups are excluded.

C... "Azure AD Connect excludes built-in security groups from directory synchronization. Azure AD Connect does not support synchronizing Primary Group memberships to Azure AD. Azure AD Connect does not support synchronizing Dynamic Distribution Group memberships to Azure AD." https://docs.microsoft.com/en-us/azure/active-directory/hybrid/concept-azure-ad-connect-sync-user-and-contacts

Answer is C. Global Security Group is a built in group in AD and built in groups are not synced. Disabled users are synced.

C is the answer!

Disabled user account should sync