Microsoft Certified: Azure Administrator AssociateManage Azure identities and governanceHard
A company is implementing a new Azure subscription. They want to delegate the ability to create new user accounts in Azure Active Directory (Azure AD) to a specific group of help desk technicians. These technicians should only be able to create standard user accounts and reset passwords for non-administrative users. They must not be able to manage other administrative roles or delete existing users. Which built-in Azure AD role should be assigned to the help desk technicians?
- AGlobal Administrator
- BHelpdesk Administrator
- CPassword Administrator
- DUser Administrator
Show answer & explanationAnswer & explanation
Correct answer: D. User Administrator
The 'User Administrator' role in Azure AD allows users to manage all aspects of users and groups, including creating and deleting users, and resetting passwords for non-administrative users. This fits the requirement to create users and reset non-admin passwords, while not granting broader administrative rights like Global Administrator.
Why the other options are wrong
- A. Global Administrator has full control over all Azure AD settings, which is too permissive for help desk technicians.
- B. Helpdesk Administrator can reset passwords for non-admins and manage service requests, but cannot create new users.
- C. Password Administrator can only reset passwords for non-administrative users, but cannot create new users.
Azure AD User Administrator Role
The 'User Administrator' role in Azure AD grants permissions to manage all aspects of users and groups, including creating, deleting, and updating users, and resetting passwords for non-administrative users.
- Can create and delete non-admin users.
- Can reset passwords for non-admin users.
- Cannot manage administrative roles.
Memory trick: For users, the User Admin is the chosen one.