You have an Azure subscription named Sub1 that contains a user named User1.
You need to ensure that User1 can purchase a Microsoft Entra Permissions Management license for Sub1. The solution must follow the principle of least privilege.
Which role should you assign to User1?
To ensure that User1 can purchase a Microsoft Entra Permissions Management license for Sub1 while adhering to the principle of least privilege, the Billing Administrator role is the most appropriate. This role allows a user to make purchases and manage subscriptions without granting broader administrative permissions like those given to a Global Administrator.
Correct
No. Don't guess. It's A. https://learn.microsoft.com/en-us/entra/permissions-management/product-roles-permissions#enabling-permissions-management Enabling Permissions Management To activate a trial or purchase a license, you must have Global Administrator permissions.
im guessing here. yes its B. pity there is no delete button
The article has been updated and now reads Billing Administrator required to purchase or active a trial. To onboard (after purchase), GA is needed. The question only asks about buying the license.
User1 need to be able to purchase the license. Only Global admins can purchase an Entra Permissions Management license, as stated in MS docs: https://learn.microsoft.com/en-us/entra/permissions-management/product-roles-permissions
I would say A. Global Administrator. "To activate a trial or purchase a license, you must have Global Administrator permissions." https://learn.microsoft.com/en-us/entra/permissions-management/product-roles-permissions#enabling-permissions-management "There are two ways to activate a trial or a full product license. The first way is to go to the Microsoft 365 admin center. • Sign in as a Global Administrator for your tenant. • Go to Setup and sign up for a Microsoft Entra Permissions Management trial. • For self-service, Go to the Microsoft 365 portal to sign up for a 45-day free trial or to purchase licenses. The second way is through Volume Licensing or Enterprise agreements. • If your organization falls under a volume license or enterprise agreement scenario, contact your Microsoft representative." https://learn.microsoft.com/en-us/entra/permissions-management/onboard-enable-tenant#activate-a-free-trial-or-paid-license
Wrong Answers: B. Billing Administrator makes purchases, manages subscriptions, manages support tickets, and monitors service health. Can’t add role assignments so cannot activate Permissions Management Administrator role. C. Permissions Management Administrator Assign the Permissions Management Administrator role to users who need to do the following tasks: • Manage all aspects of Microsoft Entra Permissions Management, when the service is present. D. User Access Administrator is an Azure RBAC role, that lets you manage user access to Azure resources. Nothing to do with Permission Management.
Ok, things have changed since I answered to this question. Before the link below said Global Admin, now it says Billing Administrator: https://learn.microsoft.com/en-us/entra/permissions-management/product-roles-permissions#enabling-permissions-management
Correct answer
The solution must follow the principle of least privilege. is the global admin is least privilege account? I think that is billing admin
Billing administrator
To complete this task, you must have at least Billing Administrator permissions. You can't enable Permissions Management as a user from another tenant who has signed in via B2B or via Azure Lighthouse. Prerequisites To enable Permissions Management in your organization: You must be eligible for or have an active assignment to the Permissions Management Administrator role as a user in that tenant. Therefore, I think that Permissions Management Administrator might be the best role. C. https://learn.microsoft.com/en-us/entra/permissions-management/onboard-enable-tenant
https://learn.microsoft.com/en-us/entra/permissions-management/product-roles-permissions - Billing Admin
https://learn.microsoft.com/en-us/entra/permissions-management/onboard-enable-tenant
No. You enable MEPM via billing admin. You use Global admin to buy licenses. Read the question. Don't guess.
Correct
The solution must follow the principle of least privilege. is the global admin is least privilege account? I think that is billing admin