Examkin

Question

Difficulty: HardAdministrative Units and License Management

Your company has a Microsoft Entra ID tenant containing an Azure subscription named Sub1. The tenant includes a support team named London-Support and an Administrative Unit named London-AU that contains users from the London office.

You need to meet the following requirements:
1. Members of the London-Support group must be able to update the department and profile information of only the users within London-AU.
2. Members of London-Support must have no administrative permissions over other users in the tenant or resources in Sub1.
3. You must automatically assign Microsoft 365 Enterprise licenses to all users who belong to London-AU.

Which two actions should you perform? (Select two.)

  1. Assign the Microsoft Entra ID User Administrator role to the London-Support group with the scope restricted to the London-AU administrative unit.Answer
  2. Create a Microsoft Entra ID security group that uses dynamic user membership, and assign the licenses to that group.Answer
  3. C
    Assign the User Administrator role to the London-Support group at the Sub1 subscription scope using Azure Role-Based Access Control (RBAC).
  4. D
    Assign the licenses directly to the London-AU administrative unit to ensure all member users inherit the licenses.

Answer

The correct actions are to assign the Microsoft Entra ID User Administrator role to the London-Support group scoped to the London-AU administrative unit, and to create a Microsoft Entra ID security group that uses dynamic user membership and assign the licenses to that group.
To delegate restricted user management, you assign a directory role (such as User Administrator) to the administrative group with the scope of the Administrative Unit. To automate licensing, you must use group-based licensing with a dynamic security group, as licensing cannot be configured directly on Administrative Units.

Step-by-Step Solution

1
Analyze how to delegate administrative permissions limited to a subset of users.
Determine that an Administrative Unit (London-AU) is the appropriate scope for delegating the User Administrator role to London-Support, which prevents them from managing users outside of the AU.
Administrative units restrict the scope of directory roles to a specific subset of the directory.
2
Analyze how directory roles differ from Azure RBAC roles.
Confirm that the User Administrator role cannot be assigned at the subscription level via Azure RBAC because directory roles and resource roles are managed on different control planes.
Microsoft Entra ID roles manage directory resources (users, groups), while Azure RBAC roles manage Azure resources (VMs, storage) in subscriptions.
3
Analyze how to automate license assignment for the scoped users.
Determine that licenses must be assigned via group-based licensing using a dynamic security group rather than directly to the Administrative Unit.
Direct license assignment to Administrative Units is not supported in Microsoft Entra ID.

Key Concept

Scoping administrative delegation using Administrative Units and automating license management using group-based licensing.
Rate this question

Topics

Administrative Units and License Management

More questions from this topic