An organization has a Microsoft Entra ID tenant. You create an Administrative Unit named Operations-AU, then add all user accounts for the operations department and a security group named Operations-Group to Operations-AU. You assign a user named Admin1 the User Administrator role scoped to Operations-AU. Admin1 needs to assign Microsoft 365 E3 licenses to all operations department users. Admin1 attempts to assign the licenses to Operations-Group, but the operation fails due to insufficient permissions. Which action should Admin1 take to successfully assign the licenses to the operations department users?
- Assign the Microsoft 365 E3 licenses directly to the individual user accounts within Operations-AU.Answer
- BRequest a Global Administrator to assign the License Administrator role to Admin1 scoped to Operations-AU.
- CAssign the Contributor role to Admin1 on the Azure subscription, then assign the licenses to Operations-Group.
- DConfigure a dynamic membership rule on Operations-Group to automatically assign the licenses to its members.
Answer
Assign the Microsoft 365 E3 licenses directly to the individual user accounts within Operations-AU.
The correct action is to assign the licenses directly to the individual user accounts within Operations-AU. As a User Administrator scoped to the administrative unit, Admin1 possesses the necessary privileges to manage user accounts within that scope, including direct license assignment. However, group-based licensing requires tenant-level License Administrator or Global Administrator privileges because configuring licenses on groups affects tenant-wide directory settings, and the License Administrator role cannot be scoped to an administrative unit.
Step-by-Step Solution
Key Concept
Administrative Unit scoped roles and the distinction between direct user licensing and group-based licensing requirements.
Estimated Time:1m 30s