SC-100 Certification Practice Question #95

Question

Your company, named Contoso, Ltd., has a Microsoft Entra tenant named contoso.com. Contoso has a partner company named Fabrikam, Inc. that has a Microsoft Entra tenant named fabrikam.com.

You need to ensure that helpdesk users at Fabrikam can reset passwords for specific users at Contoso. The solution must meet the following requirements:

•	Follow the principle of least privilege.
•	Minimize administrative effort.

What should you do? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

Accepted Answer

The Fabrikam helpdesk users are B2B guests in contoso.com. MS Learn states a guest cannot use an administrative-unit-scoped role without also holding tenant-scoped read permissions, which Directory Readers provides — that is why row 1 is Directory Readers. To restrict who they can manage to "specific users," an administrative unit is the native scoping container (a custom role changes permissions, not the user subset; an access package is entitlement-management onboarding, not directory-role scoping), giving row 2. For the actual password reset under least privilege, Password Administrator (scoped to the AU) is narrower than Helpdesk Administrator, which also grants support-request and service-health rights, so row 3 is Password Administrator. The three links cl1984 endorses map exactly to Directory Readers + administrative units + Password Administrator. Confidence is held at 84% because no answer is vote-marked and the only endorsing comment has 2 👍, though it is fully corroborated by MS Learn.

More SC-100 practice questions