Exam AZ-305 topic 1 question 52 discussion

This question is on today's exam. I passed the exam today 17-09-2023 with a score of 906/1000. The exam is easier than AZ-104.

Correct answer. Here's an explanation: The roles that you need to assign are: User1: User Administrator for the MarketingAU administrative unit. User2: Password Administrator or Helpdesk Administrator for the MarketingAU administrative unit. The User Administrator role provides permissions to manage user accounts, including creating new users. The Password Administrator and Helpdesk Administrator roles provide permissions to reset user passwords. Therefore, User1 needs the User Administrator role for the MarketingAU administrative unit to be able to create new user accounts. User2 needs either the Password Administrator or Helpdesk Administrator role for the MarketingAU administrative unit to be able to reset user passwords. Note that assigning Helpdesk Administrator for the tenant role to User2 would provide permissions to reset passwords for all users in the Azure AD tenant, not just in the MarketingAU administrative unit. https://learn.microsoft.com/en-us/azure/active-directory/roles/admin-units-assign-roles

CORRECT

Sorry, you can't create user directly in administrative unit. Just add user. So you need to create user outside the administrative unit and then add it inside. So you need User Administrator for the tenant. For User2, I think it's correct.

in the Exam April 2024

Given answer is correct

This question appeared on my Exam today 11/17/2023

Got this on Aug 5th, 2023.

answer is so obvious here, CloudJordao is right, and ofc users are part of tenant AD level, and AU's are a part of that, simple

User 1 response incorrect (impossible to answer this correctly). 1) You cannot create users in an Administrative unit, you can only create users in Azure AD, so User 1 would require the User Administrator role for the tenant. 2) You can only add/remove users within an Administrative unit, User 1 would require the Privileged Role Administrator role (or GA) to do so. https://learn.microsoft.com/en-us/azure/active-directory/roles/admin-units-members-add#prerequisites I would choose "User Administrator for the tenant" for User 1.

Given answer is correct Though question could have been written better if it had a requirement for least privilege, since User Administrator can create user and reset their passwords. So potentially could be given to both users.

correct answer. We have tested this in one of client environment.

aren't user accounts at the tenant level?

Correct answer no need Tenant level role, Admin required to create Users, HelpDesk enough to reset passwords