Your company has a Microsoft Entra ID tenant. You need to delegate administrative tasks related to Self-Service Password Reset (SSPR) and External Identities to different members of the IT support team.
Match each administration task to the least privileged administrative role required to perform the task.
- Enable Self-Service Password Reset (SSPR) for a specific group of users and configure the allowed authentication methods.Authentication Policy Administrator
- Configure tenant-wide external collaboration settings to limit guest user invitations to users with specific administrative roles.User Administrator
- Configure cross-tenant access settings to trust Multi-Factor Authentication (MFA) claims from a specific external Microsoft Entra tenant.Security Administrator
- Perform manual password resets for non-administrative users who are locked out of their accounts.Helpdesk Administrator
Answer
Enable SSPR matches with Authentication Policy Administrator; Configure external collaboration settings matches with User Administrator; Configure cross-tenant access settings matches with Security Administrator; Reset passwords for non-administrative users matches with Helpdesk Administrator.
The correct matching aligns each SSPR and External Identities task with its least privileged administrative role. The Authentication Policy Administrator role is required to manage SSPR authentication methods. The User Administrator role manages tenant-wide guest collaboration settings. The Security Administrator role is required to modify cross-tenant access settings, which dictate inbound and outbound trust relations. The Helpdesk Administrator role is the minimum role required to reset passwords for non-administrative users.
Step-by-Step Solution
Key Concept
Assigning least privileged administrative roles for Microsoft Entra ID management tasks related to SSPR and External Identities.