Your network contains an on-premises Active Directory domain named adatum.com that syncs to Azure Active Directory (Azure AD). Azure AD Connect is installed on a domain member server named Server1…

Question

Options

• ASecurity administrator
• BGlobal administrator
• CUser administrator

• A
  6% (2)
• B
  88% (28)
• C
  6% (2)

Explanation

Explanation

Global Administrator (B) is correct because modifying Azure AD Connect synchronization options requires Global Administrator privileges in Azure AD - this is a specific Microsoft requirement, as the Azure AD Connect configuration wizard explicitly needs this role to make changes to synchronization settings, and there is no lower-privileged role that grants this capability.

Security Administrator (A) is incorrect because this role is focused on managing security policies, alerts, and identity protection settings - it does not grant the ability to configure or modify Azure AD Connect synchronization options.

User Administrator (C) is incorrect because this role is scoped to managing user accounts, groups, and password resets, and has no permissions related to directory synchronization configuration.

Memory Tip: Think of Azure AD Connect as the "master bridge" between on-premises AD and Azure AD - only the highest-ranking Azure AD role (Global Administrator) holds the keys to modify how that bridge works. While this seems to violate least privilege in spirit, it's a Microsoft-imposed technical requirement, not a design choice - so on the exam, remember: "sync changes = Global Admin."

No community discussion yet for this question.