You have an Azure Active Directory Domain Services (Azure AD DS) domain named contoso.com. You need to provide an administrator with the ability to manage Group Policy Objects (GPOs). The solution…

Question

Options

• AAAD DC Administrators
• BDomain Admins
• CSchema Admins
• DEnterprise Admins
• EGroup Policy Creator Owners

• A
  89% (32)
• B
  3% (1)
• D
  6% (2)
• E
  3% (1)

Explanation

In Azure Active Directory Domain Services (Azure AD DS), the built-in group 'AAD DC Administrators' is the correct group for delegating GPO management while following the principle of least privilege. Unlike traditional on-premises AD where you would use 'Group Policy Creator Owners' for least-privilege GPO management, Azure AD DS is a managed service with a different permission model. The AAD DC Administrators group is specifically designed to grant members the necessary elevated rights within the managed domain - including creating, editing, and linking GPOs - without granting full control of the entire Azure or AAD infrastructure. Domain Admins, Schema Admins, and Enterprise Admins all grant far broader permissions than needed, violating least privilege. The Group Policy Creator Owners group exists in Azure AD DS but does not provide the same effective GPO management capability in the managed domain context.

No community discussion yet for this question.