A Microsoft 365 administrator is setting up a new Microsoft 365 tenant. The organization requires that all new user accounts created for employees automatically include their department name in the user principal name (UPN) and email address, following the format 'firstname.lastname@department.contoso.com'. Additionally, these users should also be members of an Azure AD security group corresponding to their department. Which combination of features should the administrator leverage to automate this user provisioning and management?
- AAzure AD Dynamic Groups and a custom PowerShell script for UPN/email generation.
- BAzure AD Connect for UPN sync and manual group assignment.
- CMicrosoft 365 Group naming policy and manual UPN/email configuration.
- DAzure AD User Provisioning (HR to Azure AD) and Azure AD Dynamic Groups.
Show answer & explanationAnswer & explanation
Correct answer: D. Azure AD User Provisioning (HR to Azure AD) and Azure AD Dynamic Groups.
Azure AD User Provisioning (specifically HR-driven provisioning) can automate the creation of user accounts from an HR system, including generating UPNs and email addresses based on attributes. Azure AD Dynamic Groups can then automatically add these users to department-specific security groups based on their department attribute, fulfilling all requirements for automation.
Why the other options are wrong
- A. A custom PowerShell script could generate UPN/email, but this is less integrated and scalable than HR-driven provisioning. Dynamic Groups handle the group assignment, but not the initial user creation and UPN formatting.
- B. Azure AD Connect syncs existing attributes but doesn't *generate* UPN/email based on a specific format from scratch, nor does it automate group assignments based on department.
- C. Microsoft 365 Group naming policy applies to Microsoft 365 Groups, not user UPNs/email addresses, and UPN/email configuration would still be manual for each user.
Azure AD HR-Driven User Provisioning & Dynamic Groups
A combined solution where Azure AD automates user account creation and attribute population from an HR system, and Dynamic Groups automatically manage group memberships based on user attributes.
- Automates user lifecycle from hire to retire.
- Generates UPNs and email addresses using attribute-based expressions.
- Dynamic Groups ensure users are automatically added/removed from relevant groups.
Memory trick: HR Provisioning is the 'new hire wizard', and Dynamic Groups are the 'smart department sorter'.