Microsoft Certified: Azure Administrator AssociateManage Azure identities and governanceMedium
A company wants to delegate the ability to create new user accounts in Azure Active Directory to their Human Resources (HR) department. The HR team should only be able to create standard user accounts and assign basic user properties, but not manage administrative roles or modify existing users. Which Azure AD built-in role should be assigned to the HR team?
- AGlobal Administrator
- BHelpdesk Administrator
- CUser Account Administrator
- DUser Administrator
Show answer & explanationAnswer & explanation
Correct answer: D. User Administrator
The 'User Administrator' role in Azure AD allows users to manage all aspects of users and groups, including creating and deleting users, assigning licenses, and managing groups. This role provides the necessary permissions for the HR department to create new user accounts and assign basic properties.
Why the other options are wrong
- A. Global Administrator has full control over all Azure AD settings and should never be assigned for specific, limited tasks.
- B. Helpdesk Administrator can reset passwords and invalidate refresh tokens, but not create new users.
- C. There is no built-in 'User Account Administrator' role; it might be a custom role or a misinterpretation of 'User Administrator'.
Azure AD User Administrator Role
A built-in Azure Active Directory role that grants permissions to manage all aspects of user and group accounts, including creating, deleting, and updating user properties and group memberships.
- Can create and delete users
- Can manage user properties and passwords
- Can assign licenses
- Cannot manage administrative roles
Memory trick: User Administrator is the 'staffing manager' for Azure AD.