SC-300 Exam - Question 36

Question

HOTSPOT-You have a Microsoft 365 tenant that has 5,000 users. One hundred of the users are executives. The executives have a dedicated support team. You need to ensure that the support team can reset passwords and manage multi-factor authentication (MFA) settings for only the executives. The solution must use the principle of least privilege. Which object type and Azure Active Directory (Azure AD) role should you use? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

Examice · Accepted Answer

.

Halwagy · Answer

Correct Answer:
Object Type: Administrative Unit
Role: Authentication administrator

skbudhram · Answer

Sheesh this site has a lot of wrong answers, what's the point even ..

Akakentavr · Answer

As well regarding the Authentication administrator or Helpdesk administrator options pay attention to "executives" in our case and Helpdesk administrator -Can reset passwords for non-administrators and Helpdesk Administrators.

So Authentication administrator is our choice

dule27 · Answer

Object Type: An administrative unit
Role: Authentication administrator

natazar · Answer

admin unit way to go

dejo · Answer

Object type: An administrative unit
Role: Helpdesk administrator

Helpdesk admin has less power in resetting passwords than Auth admin and others https://learn.microsoft.com/en-us/azure/active-directory/roles/permissions-reference#who-can-reset-passwords

b0tag · Answer

Should be

Administrative Unit 
Helpdesk administrator - The Authentication Administrator role is less privileged than the Helpdesk Administrator role

The Authentication Administrator role has permissions to manage authentication methods and password reset whereas the Helpdesk Administrator role has permissions to manage passwords, groups, and users.

dule27 · Answer

Object Type: An Administrative Unit
Role: Authentication Administrator

EmnCours · Answer

Object Type: Administrative Unit
Role: Authentication administrator

Remus999 · Answer

Authentication Administrator is the least privileged role to manage MFA as per https://learn.microsoft.com/en-us/azure/active-directory/roles/delegate-by-task#multi-factor-authentication

rajbne · Answer

Please update final answer

b233f0a · Answer

Role: Authentication Administrator - https://learn.microsoft.com/en-us/azure/active-directory/roles/permissions-reference#authentication-administrator - "Set or reset any authentication method (including passwords) for non-administrators"

HartMS · Answer

AU
Authentication Administrator

jojoseph · Answer

Object Type: Administrative Unit
Role: Authentication administrator

ShoaibPKDXB · Answer

Correct: Object Type: An Administrative Unit
Role: Authentication Administrator

MISCOLO · Answer

no such thing as a custom admin role

SC-300 Exam - Question 36

Discussion