SC-300 · Question #439
Hotspot Question You have a Microsoft Entra tenant that contains the users shown in the following table. The tenant contains the administrative units shown in the following table. The tenant…
The correct answer is User1 can reset the password of User3. = No; User3 can add User4 to Group2. = Yes; User5 can configure an authentication method policy that requires all Group4 members to use passwordless sign-in. = Yes. This question tests understanding of Microsoft Entra Administrative Units (AUs) and how scoped administrative roles restrict what actions administrators can perform on users and groups within specific AUs.
Question
Hotspot Question You have a Microsoft Entra tenant that contains the users shown in the following table. The tenant contains the administrative units shown in the following table. The tenant contains the groups shown in the following table. You perform the following actions:
- Assign User1 the User Administrator role for AU2.
- Assign User3 the Groups Administrator role for AU1.
- Assign User5 the Authentication Administrator role for AU3.
For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point. Answer:
Exhibits
Answer Area
- User1 can reset the password of User3.No
- User3 can add User4 to Group2.Yes
- User5 can configure an authentication method policy that requires all Group4 members to use passwordless sign-in.Yes
Explanation
This question tests understanding of Microsoft Entra Administrative Units (AUs) and how scoped administrative roles restrict what actions administrators can perform on users and groups within specific AUs.
Approach. When a role is assigned scoped to an Administrative Unit, the administrator can only manage objects (users or groups) that are members of that specific AU. User1 is a User Administrator for AU2, so they can only manage users in AU2 - not users in AU1 or AU3. User3 is a Groups Administrator for AU1, so they can only manage groups that are assigned to AU1. User5 is an Authentication Administrator for AU3, so they can only reset passwords and manage authentication methods for users in AU3 - and importantly, Authentication Administrators cannot manage Global Administrators or Privileged Role Administrators even within the AU scope. The key principle is: scoped roles are constrained to the membership of the AU they are assigned to, and the role's inherent limitations (such as Authentication Admin not being able to manage highly privileged users) still apply within that scope.
Concept tested. Microsoft Entra Administrative Units (AUs) and scoped role assignments - understanding that administrative roles assigned at the AU level are restricted to managing only the objects (users/groups) within that AU, and that role-level restrictions (e.g., Authentication Admin cannot manage Global Admins) still apply within the AU scope.
Reference. https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/administrative-units
Topics
Community Discussion
No community discussion yet for this question.