Examkin

Question

Difficulty: HardUsers and Groups in Microsoft Entra ID

Your company has a Microsoft Entra ID tenant. You need to delegate password reset capabilities to a user named Admin1. Admin1 must only be allowed to reset passwords for users who meet both of the following criteria:

* Belong to the Sales department.
* Have their usage location set to the United States (US).

You need to implement a solution that requires the minimum administrative effort and follows the principle of least privilege.

Which configuration should you implement?

  1. Create an Administrative Unit (AU), configure a dynamic membership rule for the AU using the query (user.department -eq 'Sales') -and (user.usageLocation -eq 'US'), and assign Admin1 the Helpdesk Administrator role scoped to the AU.Answer
  2. B
    Create an Administrative Unit (AU), configure a dynamic membership rule for the AU using the query (user.department == 'Sales') -and (user.location == 'US'), and assign Admin1 the Helpdesk Administrator role scoped to the AU.
  3. C
    Create a dynamic Microsoft Entra ID group with the rule (user.department -eq 'Sales') -and (user.usageLocation -eq 'US'), and assign Admin1 the Helpdesk Administrator role scoped to the group.
  4. D
    Create a dynamic Microsoft Entra ID group with the rule (user.department -eq 'Sales') -and (user.usageLocation -eq 'US'), and assign Admin1 the User Access Administrator Azure role at the subscription level.

Answer

Create an Administrative Unit (AU), configure a dynamic membership rule for the AU using the query (user.department -eq 'Sales') -and (user.usageLocation -eq 'US'), and assign Admin1 the Helpdesk Administrator role scoped to the AU.
The correct configuration uses an Administrative Unit (AU) with a dynamic membership rule configured with standard OData v3.0 query syntax (user.department -eq 'Sales') -and (user.usageLocation -eq 'US'). The Helpdesk Administrator role can be scoped to an AU, which delegates password reset permissions for the members of that AU to Admin1, satisfying the least privilege principle.

Step-by-Step Solution

1
Determine the administrative scope delegation mechanism
Administrative Unit (AU) is selected as the container for delegation
Microsoft Entra ID roles cannot be scoped to a group to delegate user administration of that group's members. Instead, Administrative Units must be used to restrict the administrative scope of directory roles.
2
Write the dynamic membership rule using correct OData syntax and attributes
(user.department -eq 'Sales') -and (user.usageLocation -eq 'US')
The dynamic query syntax requires OData v3.0 operators (e.g., -eq instead of ==) and valid user attribute names (e.g., user.usageLocation instead of user.location).
3
Assign the least privileged role to Admin1
Admin1 is assigned the Helpdesk Administrator role scoped to the AU
The Helpdesk Administrator role allows resetting passwords for non-administrator users. Scoping this role to the AU ensures Admin1 can only perform resets for users matching the AU's dynamic membership criteria.

Key Concept

Delegating administrative permissions over specific users using Administrative Units and dynamic membership rules in Microsoft Entra ID.
Rate this question

Topics

Users and Groups in Microsoft Entra ID

More questions from this topic