SC-300 Certification Practice Question #240

Question

You have a Microsoft 365 E5 subscription that contains a user named User1.

You need to ensure that User1 can create access reviews for Azure AD roles. The solution must use the principle of least privilege.

Which role should you assign to User1?

Accepted Answer

The requirement is to create access reviews specifically for Azure AD (Microsoft Entra) roles. MS Learn's PIM prerequisites are explicit that the least-privileged role for this is Privileged Role Administrator — Global Administrator also works but is broader. The Identity Governance Administrator and User Administrator roles (the main dissenting picks) can create access reviews of groups and applications, but not of directory/Entra roles, which is the distinction the question hinges on. User Access Administrator applies to Azure resource roles, not directory roles. Suggested Answer, the dominant Most Voted (39), the top comments, and MS Learn all converge on A; confidence is held just below the top band because a notable minority pushed B on a least-privilege argument that is incorrect for role-scoped reviews.

More SC-300 practice questions