Examkin

Question

Difficulty: MediumAdministrative Units and License Management

An organization implements Microsoft Entra ID. You are tasked with delegating administrative duties for a specific subset of employees. A helpdesk worker named Alex must be able to perform password resets, modify profile fields, and assign licenses for users in the Finance department only. Alex must not have administrative permissions over users in other departments. Which action should you perform?

  1. Create an administrative unit containing the Finance department users, and assign the User Administrator role to Alex scoped to the administrative unit.Answer
  2. B
    Create an administrative unit containing the Finance department users, and assign the Helpdesk Administrator role to Alex scoped to the administrative unit.
  3. C
    Create an administrative unit containing the Finance department users, and assign the User Access Administrator role to Alex scoped to the administrative unit.
  4. D
    Assign the User Administrator role to Alex at the tenant scope.

Answer

Create an administrative unit containing the Finance department users, and assign the User Administrator role to Alex scoped to the administrative unit.
The correct action is to create an administrative unit containing the Finance department users and assign the User Administrator role to Alex scoped to that administrative unit. This configuration restricts Alex's administrative capabilities (including password resets, profile edits, and license assignments) strictly to the Finance department users, satisfying the requirement of least privilege.

Step-by-Step Solution

1
Identify the scope requirement.
The requirement states that permissions must be limited to users in the Finance department only. This requires creating a Microsoft Entra ID administrative unit to define the boundary.
Administrative units allow scoping of directory role permissions to a subset of users or groups.
2
Determine the required Microsoft Entra ID role.
The role must permit password resets, profile updates, and direct license assignments. The User Administrator role has all these permissions.
The Helpdesk Administrator role lacks license assignment and full profile editing capabilities.
3
Delegate the role at the correct scope.
Assign the User Administrator role to Alex specifically scoped to the newly created administrative unit.
This limits Alex's User Administrator permissions to only the users within the Finance administrative unit, fulfilling the least privilege constraint.

Key Concept

Delegating Microsoft Entra ID directory roles scoped to an administrative unit to enforce the principle of least privilege.
Rate this question

Topics

Administrative Units and License Management

More questions from this topic