AZ-104 Certification Practice Question #75

Question

You have three offices and an Azure subscription that contains an Azure Active Directory (Azure AD) tenant.
You need to grant user management permissions to a local administrator in each office.
What should you use?

Accepted Answer

To grant user management permissions to local administrators restricted to their respective office (location), you should use administrative units (Option B). In Microsoft Entra ID (formerly Azure AD), an administrative unit is a container for users, groups, or devices. A Global or Privileged Role Administrator can assign a directory role (such as User Administrator) to a local administrator with the scope limited to a specific administrative unit. This prevents the local office administrators from having tenant-wide privileges, aligning with the principle of least privilege. Azure AD roles (Option A) are tenant-wide by default, and Azure roles (Option D) are used to manage Azure infrastructure resources rather than Entra ID directory objects.

More AZ-104 practice questions