Exam MS-102 topic 1 question 31 discussion

IdFix & Domain Users You only need to identify problems, so no rights needed to fix them. https://microsoft.github.io/idfix/Step%201%20-%20Review%20the%20prerequisites/#permissions

IdFix Domain Users The application runs in the context of the authenticated user, which means that it will query the authenticated forest and must have rights to read the directory.

✅ Tool: IdFix IdFix is a Microsoft tool designed to help you identify and remediate directory issues (e.g., duplicate or invalid attributes) before syncing with Azure AD. It's lightweight, read-only, and doesn't require elevated privileges for use. ✅ Required group membership: Domain Users IdFix only requires read access to Active Directory, which a member of the Domain Users group already has. This satisfies the requirement to follow the principle of least privilege — no need for elevated rights like Domain Admin or Enterprise Admin. ✅ Final Answers: Field Selection Tool IdFix Required group membership Domain Users

Regular" users who have accounts in an Active Directory domain are, by default, able to read much of what is stored in the directory, but are able to change only a very limited set of data in the directory. https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/plan/security-best-practices/appendix-b--privileged-accounts-and-groups-in-active-directory

- IdFix - Domain Users

IdFix & Domain Users - any authenticated user can use the tool to view but not to edit The application runs in the context of the authenticated user, which means that it will query the authenticated forest and must have rights to read the directory. If you want to apply changes to the directory, the authenticated user needs read/write permission to the desired objects.

lare confuser

It can be domain users as they're considered authenticated users, which is the MINIMUM requirement to run the tool

It says "identify" not "fix" the potentials issues so i'll go with "IdFix & Domain Users"

This must be domain admin and IDFix. A account needs read and write permissions to the domain.

Thinking IdFix and GAdministrator https://lazyadmin.nl/it/idfix/ But to use the tool your will need of course to have read and write access to the Active Directory