Examkin

Question

Difficulty: HardSelf-Service Password Reset and External Identities

An organization wants to delegate management of Self-Service Password Reset (SSPR) and external collaboration configurations to different administrators using the principle of least privilege.

Which minimum administrative roles must be assigned to perform each of the specified directory and external identity configuration scenarios?

  • Configure federation with Google or Facebook as external identity providers for B2B collaboration.External Identity Provider Administrator
  • Invite external guest users to the tenant when guest invitations are restricted to administrative roles in external collaboration settings.Guest Inviter
  • Configure tenant-wide Self-Service Password Reset (SSPR) authentication methods and registration policies.Authentication Policy Administrator
  • Reset the password of a user who is assigned the Helpdesk Administrator role.User Administrator

Answer

Configure federation with Google or Facebook maps to External Identity Provider Administrator; Invite external guest users maps to Guest Inviter; Configure tenant-wide SSPR settings maps to Authentication Policy Administrator; Reset the password of a Helpdesk Administrator maps to User Administrator.
The correct matches pair each directory administration task with its minimum required role based on the principle of least privilege. External Identity Provider Administrator manages federation, Guest Inviter permits B2B invitations under restrictions, Authentication Policy Administrator manages SSPR methods, and User Administrator handles password resets for Helpdesk Administrators.

Step-by-Step Solution

1
Analyze the role required for external identity provider federation.
Configuring Google or Facebook federation requires managing identity providers, which corresponds to the External Identity Provider Administrator role.
This role is dedicated to setting up external federation options for B2B collaboration without requiring broader Global Administrator privileges.
2
Determine the minimum role required for B2B guest invitations under restricted settings.
Inviting B2B guest users when restrictions are in place maps to the Guest Inviter role.
The Guest Inviter role is specifically scoped to bypass guest invitation restrictions for standard users without granting general directory management capabilities.
3
Identify the minimum administrative role that can modify global SSPR settings.
Managing tenant-wide SSPR authentication methods and policies maps to the Authentication Policy Administrator role.
The Authentication Policy Administrator is the least-privileged directory role that can manage authentication policies, registration policies, and security questions.
4
Determine which role can reset the password of a Helpdesk Administrator.
Resetting the password of a Helpdesk Administrator requires the User Administrator role.
Helpdesk Administrators can only reset passwords for non-administrative users. User Administrators can reset passwords for non-administrators and specific administrative roles including Helpdesk Administrator, but cannot reset passwords for high-privileged roles like Global Administrator.

Key Concept

Delegating administrative permissions using least privilege for Microsoft Entra ID Self-Service Password Reset (SSPR) and external collaboration settings.
Rate this question

Topics

Self-Service Password Reset and External Identities

More questions from this topic