SC-300 Certification Practice Question #69

Question

You have a Microsoft Entra tenant named contoso.com that contains an administrative unit named AU1 and two users named User1 and User2. User1 is a member of AU1.

You need to perform the following role assignments:

•	User1: Security Administrator
•	User2: User Administrator

For which scopes can each user be assigned the role? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

Accepted Answer

The question asks which **scopes** each role CAN be assigned at. MS Learn's authoritative "Roles that can be assigned with administrative unit scope" table lists **User Administrator** but omits **Security Administrator**; assigning an unsupported role at AU scope returns HTTP 400 ("The given built-in role is not supported to be assigned to a single resource scope"). Therefore Security Administrator (User1) can only be assigned tenant-wide = **contoso.com only**, while User Administrator (User2) can be assigned at either AU1 or tenant scope = **AU1 and contoso.com**. The minority view that User2 needs AU1 membership is wrong: MS Learn states "Administrators don't have to be members of the administrative unit they manage," and User1's AU1 membership is a distractor irrelevant to the Security Administrator role's scopability. The top two community answers (8 and 5 👍), both grounded in the same docs, agree with this. Confidence sits in the 82-89 HOTSPOT band given a clear MS Learn basis with only low-vote dissent.

More SC-300 practice questions