You have a Microsoft 365 E5 subscription. You must create a dynamic device group that includes any device whose name contains the word Marketing. Which device membership rule should you use?

The correct rule is (device.displayName -contains "Marketing") because the -contains operator in Azure AD dynamic group rules checks if a string attribute (like displayName) includes a specified substring. It performs a partial match, so any device name with "Marketing" anywhere within it will be included. The options using -in are incorrect because -in is used to check if an attribute's value is present within a list of specified values, not for substring matching within a single value. For example, (device.displayName -in ["Marketing1", "Marketing2"]) would work, but not with a single string or wildcards for partial matching. The options including asterisks (Marketing) are also incorrect. While asterisks are commonly used as wildcards in other contexts (like PowerShell or file systems), they are not used with the -contains operator in Azure AD dynamic group rules. The -contains operator inherently handles partial string matching without the need for explicit wildcards.