Confident problem with AZ-104 Practice set 3 question

[An-L]

There is a question in practice set three, as follows:

“6 Your organization Azure subscription contains the following identities:
Name | Type | Member of
TDU1 | User | TDGrp1
TDU2 | User | TDGrp1
TDU3 | User | None
TDSP1 | Managed Identity | TDGrp1
TDSP2 | Managed Identity | None

You created an alert rule and configured an action group with the notification type Email Azure Resource Manager Role, which sends an email to the Monitoring Reader role. The Monitoring Reader role is assigned to the user, service principal and group. Which of the following identities will receive an email notification?

• TDU1, TDU2, TDU3, TDSP1, and TDSP2
• TDU3
• TDU3 and TDSP2
• TDU1, TDU2, and TDSP1″

Your exam says that the correct answer is ‘TDU3 only’, however

• The question makes no mention of whether any of the users (including the apparently correct answer TDU3) are members of the resource’s managing ‘Reader’ role. We can only infer that it is once we are told TD3 is a correct answer, since the only notification type is ‘Email Azure Resource Manager’

• The ONLY difference between TDU3 vs TDU1 or TDU2 is that 1 & 2 are members of some arbitrary group called TDGrp1. The group is not otherwise mentioned in the question, only that those three users are a member of it. So if TDU3 is a correct answer, and we assume it to be a member of the resource’s managing ‘Reader’ role, why should we ‘not’ assume that TDU1 and TDU2 are also members of the role and therefore receive the email also?

  Something seems to be wrong with at least the ‘correct’ answer if not also the question.
  This looks like a question that used to be more complete, but has been cut back down and had information removed, but not fully updated to compensate?

[N Pateson V]

Same question here except you stated that TDU3 is a member of the RDGrp1 which they are not. Question says member of ‘None’.

I think the question is whether or not TDU1 and TDU2 should also receive the email notifications as they inherit the RBAC assignment from their group (TDGrp1)

• This reply was modified 2 months, 3 weeks ago by  N Pateson V.

[N Pateson V]

Specifically a statement in the TD solution says “Microsoft Entra groups and service principals are not emailed.”

Is that statement correct? Given that I scouted through Microsoft to find the section that addresses this and it states “<b style=”font-family: inherit; font-size: inherit;”>Email Azure Resource Manager

When you use Azure Resource Manager for email notifications, you can send email to the members of a subscription’s role. Email is sent to Microsoft Entra ID user or group members of the role.”

[JR-TutorialsDojo]

Hello, An-L and N Pateson V.

Thank you for bringing this to our attention. We’ve reviewed the question and the supporting documentation.

Back in 2023, Microsoft’s documentation stated that “Email is only sent to Microsoft Entra ID user members of the role.” – https://learn.microsoft.com/en-us/answers/questions/1466648/cannot-get-action-group-)-email-azure-resource-man

However, the current documentation has since been updated. It now states: “Email is sent to Microsoft Entra ID user or group members of the role.” – https://learn.microsoft.com/en-us/azure/azure-monitor/alerts/action-groups#email-azure-resource-manager

This means that group members are now included in the notification scope, whereas previously only directly assigned user accounts were considered.

We acknowledge this change and will make the necessary updates to the practice question and answer key to align with the latest Microsoft documentation.

Thank you for catching this! Let us know if you need further assistance.

Best regards,
JR @ Tutorials Dojo