Hotspot Question You have a Microsoft Entra tenant that contains the users shown in the following table. You configure the Temporary Access Pass settings as shown in the following exhibit. You add…

Question

Exhibits

Answer Area

• Admin1 can view the Temporary Access Pass of Admin2.Yes
• Admin2 can add the Temporary Access Pass authentication method to User1.Yes
• Admin2 can add the Temporary Access Pass authentication method to Admin1.No

Explanation

Admin1 (a Global Administrator) can view the Temporary Access Pass of Admin2 because Global Administrators have visibility into authentication methods of other users, including other admins, making Statement 1 'Yes'. Admin2, as an Authentication Administrator, can create Temporary Access Passes for regular users (User1) but cannot manage authentication methods for privileged admin roles like Global Administrator (Admin1), because Authentication Administrators are restricted from modifying accounts with higher or equal privilege levels - making Statement 2 'Yes' and Statement 3 'No'. This follows Microsoft Entra's role hierarchy where Authentication Administrators can manage non-admin users and users with non-privileged roles, but not Global Administrators or other privileged role holders.

No community discussion yet for this question.