nerdexam
Microsoft

AZ-305 · Question #307

Drag and Drop Question You have an Azure AD tenant that contains an administrative unit named MarketingAU. MarketingAU contains 100 users. You create two users named User1 and User2. You need to…

The correct answer is User Administrator for MarketingAU; Helpdesk Administrator for MarketingAU. User1 needs the User Administrator role scoped to MarketingAU because this role grants permission to create and manage user accounts within the administrative unit. User2 needs the Helpdesk Administrator role scoped to MarketingAU because this role specifically grants the…

Submitted by ricky.ec· Mar 6, 2026Manage Azure Active Directory identities - specifically, managing administrative units and scoped role assignments in Azure AD (Microsoft Entra ID)

Question

Drag and Drop Question You have an Azure AD tenant that contains an administrative unit named MarketingAU. MarketingAU contains 100 users. You create two users named User1 and User2. You need to ensure that the users can perform the following actions in MarketingAU: - User1 must be able to create user accounts. - User2 must be able to reset user passwords. Which role should you assign to each user? To answer, drag the appropriate roles to the correct users. Each role may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content. NOTE: Each correct selection is worth one point. Answer:

Exhibit

AZ-305 question #307 exhibit

Answer Area

Drag items

Helpdesk Administrator for MarketingAUHelpdesk Administrator for the tenantUser Administrator for MarketingAUUser Administrator for the tenant

Correct arrangement

  • User Administrator for MarketingAU
  • Helpdesk Administrator for MarketingAU

Explanation

User1 needs the User Administrator role scoped to MarketingAU because this role grants permission to create and manage user accounts within the administrative unit. User2 needs the Helpdesk Administrator role scoped to MarketingAU because this role specifically grants the ability to reset passwords for users within that administrative unit. Scoping roles to the administrative unit (rather than the entire tenant) follows the principle of least privilege, limiting the users' permissions only to the 100 users within MarketingAU.

Topics

#Azure AD Administrative Units#Role-Based Access Control (RBAC)#Least Privilege#Azure AD Roles

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full AZ-305 Practice