SC-300 Certification Practice Question #45

Question

You have an Azure AD tenant that contains a user named Admin1.

You need to ensure that Admin1 can perform only the following tasks:

•	From the Microsoft 365 admin center, create and manage service requests.
•	From the Microsoft 365 admin center, read and configure service health.
•	From the Azure portal, create and manage support tickets.

The solution must minimize administrative effort.

What should you do?

Accepted Answer

The requirement is that Admin1 perform **only** the three listed tasks. The Helpdesk Administrator role does grant all three permissions (`microsoft.azure.serviceHealth`, `microsoft.azure.supportTickets`, `microsoft.office365.serviceHealth`, `microsoft.office365.supportTickets`), which is why hellawaits111's C comment is the single highest-voted post (21 👍). However, Helpdesk Administrator is a privileged role that also resets passwords and invalidates refresh tokens, so it grants well beyond the three tasks and fails the "only" constraint. No built-in role maps to exactly those three permissions and nothing more, so per MS Learn best-practice guidance ("If there isn't a built-in role that meets your need, you can create your own custom roles"), a custom role is the correct mechanism. The official Suggested Answer and the overwhelming 81-vote consensus both land on D. Confidence is held at 81% because of the genuine community split: the "minimize administrative effort" wording leads some to C, and the top single comment is a C vote — but the hard "only" requirement and the privileged extra permissions of Helpdesk Administrator make D the defensible answer.

More SC-300 practice questions