SC-300 Question 35

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• 5

  The key part of this question is the requirement that these settings be changed or managed for ONLY the executives. From the who can reset passwords page (https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/admin-units-assign-roles#roles-that-can-be-assigned-with-administrative-unit-scope) it notes that additional restrictions apply to roles scoped to administrative units. Once you create an AU there is then a smaller selection of eligible roles that can be assigned, and the further restrictions page (https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/admin-units-assign-roles#roles-that-can-be-assigned-with-administrative-unit-scope) states that the Authentication Administrator "Has access to view, set, and reset authentication method information for any non-admin user in the assigned administrative unit ONLY." This accomplishes our goal of ensuring the administrator permissions would only extend to members of of the AU (executives). Therefore the answer is: Administrative Unit & Authentication Administrator

• 2

  To meet the requirement of allowing the support team to reset passwords and manage MFA settings for only the executives while adhering to the principle of least privilege, you can follow this approach: Object Type: Azure AD Group You should use an Azure AD group to define the executives as a specific set of users. Create a group that contains only the 100 executives, which will limit the scope of operations to this group. Azure AD Role: Authentication Administrator Assign the Authentication Administrator role to the support team for this specific group. This role allows resetting passwords, managing multi-factor authentication (MFA) settings, and configuring authentication policies, but only for the users within the assigned scope (in this case, the executives group). Summary: Object Type: Azure AD Group Azure AD Role: Authentication Administrator

• 1

  Copilot: To ensure that the support team can reset passwords and manage multi-factor authentication (MFA) settings for only the executives while adhering to the principle of least privilege, you should use the following: Object Type: Create a group in Azure AD that includes only the executives. Azure AD Role: Assign the Authentication Administrator role to the support team members. This role allows them to reset passwords and manage MFA settings, but only for users who are assigned to specific roles or groups. By creating a group for the executives and assigning the Authentication Administrator role to the support team, you ensure that the support team has the necessary permissions to manage only the executives' accounts without having broader access