Examkin

Question

Difficulty: HardAdministrative Units and License Management

Your company has a Microsoft Entra ID tenant. You need to delegate user and license administration tasks for the Sales department. The solution must meet the following requirements:
- A user named Admin1 must be able to reset passwords and manage license assignments for users in the Sales department.
- Admin1's administrative permissions must be restricted to the Sales department users only.
- Licensing conflicts for Sales department users must be resolved by prioritizing group-based licensing over direct assignments.

Which four actions should you perform in sequence? (To answer, arrange the appropriate actions from the list of actions in the correct order.)

  1. 1Create an administrative unit named Sales-AU and add the Sales department users to it.
  2. 2Assign the User Administrator role to Admin1 with the scope set to Sales-AU.
  3. 3Assign the license to the Sales-Group security group that contains the Sales department users.
  4. 4Remove the direct license assignments from the individual user accounts in Sales-AU.

Answer

The correct sequence is: First, create the Sales-AU administrative unit and add the Sales department users. Next, assign the User Administrator role to Admin1 at the Sales-AU scope. Then, assign the license to the Sales-Group security group. Finally, remove the direct license assignments from the individual user accounts.
To delegate management of a specific subset of users, you must first define that scope using an administrative unit (Sales-AU) and add the users to it. Next, assign the User Administrator role to Admin1, scoping it specifically to the Sales-AU. Group-based licensing is configured by assigning the license to the security group containing the users. Finally, direct user-level licenses are removed to resolve conflicts and fully transition to group-based licensing.

Step-by-Step Solution

1
Create an administrative unit named Sales-AU and add the Sales department users to it.
An administrative boundary (Sales-AU) containing only the Sales department users is established.
This sets up the scope for delegating administrative tasks.
2
Assign the User Administrator role to Admin1 with the scope set to Sales-AU.
Admin1 is granted User Administrator rights restricted only to the members of Sales-AU.
This complies with the principle of least privilege, preventing Admin1 from managing users outside the Sales department.
3
Assign the license to the Sales-Group security group that contains the Sales department users.
Group-based licensing is configured, allowing all group members to inherit the license.
This establishes group-based licensing as required to minimize administrative overhead.
4
Remove the direct license assignments from the individual user accounts in Sales-AU.
The direct assignments are cleared, leaving only the inherited group licenses active.
This resolves licensing conflicts and ensures that licensing is managed at the group level.

Key Concept

Administrative Units (AUs) allow scoping directory roles (such as User Administrator) to a subset of users. Group-based licensing enables license assignment to a group, which is inherited by its members. Transitioning from direct to group-based licensing requires assigning the license to the group and then removing the direct assignments from individual users.
Rate this question

Topics

Administrative Units and License Management

More questions from this topic