AZ-500 Question 7
Single answerYou are a security engineer for Contoso. The HR department requests a custom role that grants the ability to reset passwords and update contact information only for user accounts in the HR department. They also need to ensure that no permissions are granted to manage service principals or other users outside the HR department. You decide to create a custom Microsoft Entra role to satisfy these requirements. Which approach should you use?
- A
Create a custom Azure RBAC role scoped to a resource group that contains all HR employees.
- B
Assign the built-in User Administrator role directly to the HR department’s global security group.
- C
Create a custom Microsoft Entra role with the required directory permissions, configure an Administrative Unit (AU) containing only the HR users, and then assign the role to that AU.
- D
Create a custom Microsoft Entra role with Reset Password and Manage Service Principal permissions, assigned at a global directory scope.
Show answer and explanation
Correct answer: C
Explanation
When controlling permissions that affect user accounts in Microsoft Entra ID, using Administrative Units (AUs) is a best practice. You create a custom Microsoft Entra role that grants only the necessary permissions, such as resetting passwords and editing profiles, and scope it to the AU covering only HR users. This prevents managing accounts outside the HR department and avoids granting privileges related to service principals. Refer to Microsoft’s documentation on 'Administrative Units in Microsoft Entra ID' for more details on configuring fine-grained directory permissions.
- A. Incorrect.
Option 1 is incorrect because Azure RBAC roles apply to Azure resources (e.g., subscriptions, resource groups, and resources) rather than directory objects like users. This does not limit password resets and contact updates to only the HR department’s users.
- B. Incorrect.
Option 2 is incorrect because the built-in User Administrator role typically allows managing passwords for all users except for global admins, not just HR accounts. It does not limit permissions to a specific subset of users.
- C. Correct.
Option 3 is correct. Creating a custom Microsoft Entra role with only the needed permissions (e.g., resetting passwords, updating profile attributes) and assigning the role to an Administrative Unit containing only HR users ensures that the role applies only to that group. This method prevents managing service principals or other users outside the HR department.
- D. Incorrect.
Option 4 is incorrect because assigning a custom Microsoft Entra role at the global directory scope would allow the assigned user to reset passwords for all users, not just the HR department.