Microsoft 365 Certified: Administrator ExpertDeploy and manage a Microsoft 365 tenantHard
A Microsoft 365 administrator needs to delegate the ability to reset passwords for all users in the 'Sales' department without granting them broader administrative privileges. The Sales department users are organized into a specific Azure AD administrative unit. Which role and scope should the administrator assign?
- AGlobal Administrator role scoped to the 'Sales' administrative unit
- BHelpdesk Administrator role scoped to the 'Sales' security group
- CPassword Administrator role scoped to the entire tenant
- DUser Administrator role scoped to the 'Sales' administrative unit
Show answer & explanationAnswer & explanation
Correct answer: D. User Administrator role scoped to the 'Sales' administrative unit
Assigning the 'User Administrator' role, which includes the ability to reset passwords, and scoping it to the 'Sales' administrative unit ensures that the delegated administrator can only manage users within that specific department, adhering to the principle of least privilege.
Why the other options are wrong
- A. Global Administrator grants excessive privileges beyond password reset and should never be used for limited delegation.
- B. Helpdesk Administrator is a valid role, but scoping to a security group is not how administrative units are leveraged for delegation.
- C. Password Administrator role scoped to the entire tenant grants broader access than required, violating least privilege.
Azure AD Administrative Units
Containers for Azure AD users and groups that can be used to delegate administrative privileges over a specific subset of an organization's users or groups.
- Enable granular delegation of administrative roles.
- Ideal for large, distributed organizations.
- Adhere to the principle of least privilege.
- Can scope roles like User Administrator, Password Administrator, Helpdesk Administrator.
Memory trick: Administrative Units are like departmental safes, allowing you to give specific keys only to those who need to open that department's user accounts.