SC-300 Certification Practice Question #243

Question

You have a Microsoft 365 E5 subscription that contains the users shown in the following table.

The users are assigned the roles shown in the following table.

For which users can User1 and User4 reset passwords? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

Accepted Answer

User1 is an Organization-scoped Password Administrator, so the tenant-level "Who can reset passwords" rules apply: it can reset non-admins (User3, User5) and other Password Admins (User4), but NOT the Global Reader (User2 holds a privileged role outside the Password Admin's allowed list). That yields {User3, User4, User5}, the only dropdown option that fits. User4 is a Password Administrator scoped to AU1, where MS Learn restricts the role to "non-administrators within the assigned administrative unit only," and explicitly forbids resetting any user holding an organization-wide role (to prevent elevation of privilege). Within AU1 (User1, User2, User3), User1 and User2 are org-scoped admins (blocked) and User3 is a non-admin (allowed) — so User4 → User3 only. The high-vote "1,2,3" answer fails MS Learn on two counts (Global Reader is privileged, and AU-scoped admins can't reset org-scoped admins), so it is discounted. Confidence is held at 80% because the answer area shows no official Suggested Answer and the community is genuinely split; however the chosen rows are the only ones fully consistent with the MS Learn permission tables.

More SC-300 practice questions