Microsoft Certified: Azure Administrator AssociateManage Azure identities and governanceMedium
A company wants to delegate the ability to reset passwords for standard user accounts in Azure Active Directory to their help desk team. The help desk team should NOT be able to modify any other user properties, create new users, or manage administrative accounts. Which built-in Azure AD role should be assigned to the help desk team?
- AHelpdesk Administrator
- BAuthentication Administrator
- CUser Administrator
- DPassword Administrator
Show answer & explanationAnswer & explanation
Correct answer: D. Password Administrator
The 'Password Administrator' role is specifically designed for this scenario. It allows users to reset passwords for non-administrators and assign, remove, or update authentication methods for non-administrators, without granting broader user management privileges.
Why the other options are wrong
- A. The 'Helpdesk Administrator' role is broader than required, allowing password resets for non-administrators and certain service administrators, managing service requests, and monitoring service health.
- B. The 'Authentication Administrator' role manages authentication methods for all users, including administrators, and can enforce MFA, but it's not solely focused on password resets for standard users and is broader in scope.
- C. The 'User Administrator' role can create and manage all aspects of users and groups, including resetting passwords for administrators, which is too broad for the requirement.
Azure AD Password Administrator Role
The Azure AD 'Password Administrator' role allows designated users to reset passwords for non-administrator users and manage their authentication methods, adhering to the principle of least privilege.
- Can reset passwords for non-administrator users.
- Can manage authentication methods for non-administrator users.
- Does NOT allow creating users, modifying other user properties, or managing administrators.
Memory trick: The Password Admin is the keymaster for standard users, nothing more.