Your company has an Azure AD tenant that contains a user named User1. The company has two departments named marketing and finance. You need to grant permissions to User1 to manage only the users in…

Question

Options

• Aa management group
• Ban administrative unit
• Ca resource group
• Da Microsoft 365 group

• A
  4% (1)
• B
  83% (20)
• C
  4% (1)
• D
  8% (2)

Explanation

Explanation

Administrative Units (Option B) are the correct choice because they allow you to scope administrative permissions to a subset of users within Azure AD - in this case, only the marketing department's users. By placing marketing users into an administrative unit and assigning User1 a scoped role (like User Administrator) over that unit, User1 gains management rights exclusively over those users, with no access to finance department users.

Why the distractors are wrong:

• A. Management Groups are used to organize Azure subscriptions for governance and policy, not to scope permissions over Azure AD users.
• C. Resource Groups are Azure Resource Manager containers for resources (VMs, storage, etc.), not for managing Azure AD user accounts.
• D. Microsoft 365 Groups are collaboration groups (email, Teams, SharePoint), and while they organize users, they do not provide a mechanism to scope administrative roles to specific users.

Memory Tip

Think of Administrative Units as "departments within Azure AD" - just like a company has departments with their own managers, Administrative Units let you create boundaries so admins only manage their slice of users. If the question mentions restricting admin scope to a subset of Azure AD users, always think Administrative Units.

No community discussion yet for this question.