MS-102 Question #45: Real Exam Question with Answer & Explanation

Question

You have a Microsoft 365 subscription that uses an Azure AD tenant named contoso.com. The tenant contains the users shown in the following table. You add another user named User5 to the User Administrator role. You need to identify which two management tasks User5 can perform. Which two tasks should you identify? Each correct answer presents a complete solution. NOTE: Each correct selection is worth one point.

Options

• ADelete User2 and User4 only.
• BReset the password of User4 only.
• CReset the password of any user in Azure AD.
• DDelete User1, User2, and User4 only.
• EReset the password of User2 and User4 only.
• FDelete any user in Azure AD.

Explanation

A User Administrator can manage less privileged administrative roles, which includes resetting passwords and deleting accounts for Helpdesk and Password Administrators.

Common mistakes.

• B. This option is incomplete as User5 can also reset the password of User2, not just User4.
• C. A User Administrator cannot reset the password of any user in Azure AD, specifically excluding highly privileged roles like Global Administrator and Billing Administrator.
• D. User5 cannot delete User1 (Global Administrator) as Global Admin is a higher-privileged role that User Administrator cannot manage.
• F. A User Administrator cannot delete any user in Azure AD, as they are restricted from deleting users with higher-privileged administrative roles like Global Administrator and Billing Administrator.

Concept tested. Azure AD built-in role permissions (User Administrator)

Reference. https://learn.microsoft.com/en-us/azure/active-directory/roles/permissions-reference#user-administrator

No community discussion yet for this question.