MS-102 Question 29

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• 1

  Idfix and Enterprise Admins Why: Among the four roles you listed — Domain Admins, Domain Users, Server Operators, and Enterprise Admins — the most appropriate role for using IdFix, while ensuring it works properly, is: ✅ Enterprise Admins Here's a breakdown: Domain Users > Can't use iDFix Server Operators > Can't use iDFix Domain Admins > can use IDfix > Has full access, but may exceed least privilege Enterprise Admins > can use IDfix > Can access all domains in a forest, suitable for large environments 🛡️ Least Privilege Consideration: While Enterprise Admins can run IdFix successfully, it's not the ideal choice if you're strictly following the principle of least privilege. The best practice would be to create a custom account with read-only permissions on the relevant Organizational Units (OUs) in Active Directory.

• 1

  IDFix Domain Users The question asks "you need to identify" Domain Users can read users and other objects in Active Directory. This article helped me understand how and where the permissions are, and how to deny specific users from reading other domain objects or users. https://learn.microsoft.com/en-us/archive/technet-wiki/6130.how-to-hide-objects-in-active-directory-from-specific-users

• 1

  ✅ Tool: IdFix IdFix is a Microsoft tool designed to help you identify and remediate directory issues (e.g., duplicate or invalid attributes) before syncing with Azure AD. It's lightweight, read-only, and doesn't require elevated privileges for use. ✅ Required group membership: Domain Users IdFix only requires read access to Active Directory, which a member of the Domain Users group already has. This satisfies the requirement to follow the principle of least privilege — no need for elevated rights like Domain Admin or Enterprise Admin. ✅ Final Answers: Field Selection Tool IdFix Required group membership Domain Users