will be in charge of Azure AD Support issues. This new employee needs the ability to reset the passwords for all types of users when requested, including users with the user admin, global admin, or…

Question

Options

• APassword Admin
• BGlobal Admin
• CSecurity Admin
• DUser Admin

• A
  17% (8)
• B
  70% (32)
• C
  9% (4)
• D
  4% (2)

Explanation

Explanation

Global Admin (Option B) is correct because it is the only role in Azure AD that can reset passwords for all user types, including those with privileged roles like Global Admin, User Admin, and Password Admin. By design, lower-privileged roles cannot reset passwords for users with equal or higher-level roles, making Global Admin a necessity in this specific scenario - and therefore not a violation of least privilege, since no lesser role can fulfill the requirement.

Password Admin (Option A) can only reset passwords for non-admin users and other Password Admins, so it cannot handle resets for User Admins or Global Admins. Security Admin (Option C) manages security policies and is not designed for password reset tasks at all. User Admin (Option D) can reset passwords for most users but is explicitly blocked from resetting passwords for Global Admins or other User Admins.

Memory Tip: Think of it as a hierarchy of power - only a Global Admin can "override" all other admins. When the job requirement explicitly includes resetting passwords for Global Admins themselves, only a Global Admin can do that, making it the least-privileged role that still satisfies the full requirement.

No community discussion yet for this question.