Examkin

Question

Difficulty: MediumUsers and Groups in Microsoft Entra ID

You manage a Microsoft Entra ID tenant. You create an administrative unit named Regional-AU and add several security groups to it.

You need to delegate the ability to manage the membership of these security groups to a user named Admin1. The solution must follow the principle of least privilege.

Which role and scope should you assign to Admin1?

  1. A
    Groups Administrator role scoped to an Azure resource group
  2. B
    User Administrator role scoped to Regional-AU
  3. Groups Administrator role scoped to Regional-AUAnswer
  4. D
    Contributor role scoped to the Azure subscription

Answer

Groups Administrator role scoped to Regional-AU
Assigning the Groups Administrator role scoped to Regional-AU is correct because it grants the specific permissions needed to manage group memberships, and administrative units allow directory role delegation to be scoped to a subset of directory objects, satisfying the principle of least privilege.

Step-by-Step Solution

1
Identify the administrative tasks and the target objects.
The task is to manage membership for security groups placed inside an Administrative Unit.
Understanding the scope of administration helps narrow down the required role and boundary.
2
Compare the permissions of User Administrator and Groups Administrator.
Groups Administrator allows managing group properties and memberships. User Administrator has broader access, including user and password management.
Least privilege requires choosing the role with the fewest permissions that still accomplishes the task.
3
Determine the appropriate scope for the assignment.
The groups are contained within Regional-AU. Directory roles can be scoped to administrative units, whereas Azure RBAC scopes (resource groups/subscriptions) cannot be used for directory roles.
Assigning the role at the administrative unit scope ensures the permission is restricted to the specific groups.

Key Concept

Delegating group management using Administrative Units and least privilege directory roles
Estimated Time:1m 30s
Rate this question

Topics

Users and Groups in Microsoft Entra ID

More questions from this topic