Exam MS-102 topic 1 question 167 discussion

- Cloud Device Administrator - Licence Administrator

Answer is correct as Helpdesk Administrator has action of: microsoft.directory/bitlockerKeys/key/read - Read bitlocker metadata and key on devices and License Administrator has: microsoft.directory/users/usageLocation/update - Update usage location of users

ChatGPT o3: Assign the following two roles to Admin1: Helpdesk Administrator Allows viewing BitLocker recovery keys for Azure AD–joined Windows devices. This role can read BitLocker recovery keys for any Azure AD‑joined Windows device but cannot manage or delete devices. Using Cloud Device Administrator would also work, but it grants broader device‑management permissions, so Helpdesk Administrator is the safer minimum. License Administrator Allows setting the "Usage location" attribute for users (required for assigning licenses). License Administrators can assign, remove, and manage product licenses, which includes setting or changing the Usage location property required for license assignment. No broader user‑admin rights are needed. These roles satisfy the requirements using the principle of least privilege.

Given Answer Correct Helpdesk Administrator: This role allows Admin1 to view BitLocker recovery keys. According to Microsoft documentation, a help desk technician can use the Microsoft Intune admin center to help an end user get a recovery key for their device1. https://learn.microsoft.com/en-us/mem/configmgr/tenant-attach/bitlocker-recovery-keys License admin Assign the License admin role to users who need to assign and remove licenses from users and edit their usage location. License admins also can: • Reprocess license assignments for group-based licensing • Assign product licenses to groups for group-based licensing https://learn.microsoft.com/en-us/microsoft-365/admin/add-users/about-admin-roles?view=o365-worldwide

Cloud Device admin is less privilege than helpdesk admin. With helpdesk admin, one can reset the password of another non-admin user, but that user could have access to alot more sensitive information otherwise. Cloud Device admin the most damage he can do is to delete some devices in Entra ID, this does not means data leak compare to an unauthorised access whose may be the owner serveral subscriptions due to password reset by the helpdesk admin.

Given answer is INCORRECT, Cloud Device Admin is the LEAST PRIVILEGED. Remember this exam is open learn.microsoft.com Please reference https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/delegate-by-task THIS HAS ALL THE LEAST PRIVILEGED stated. Helpdesk has MORE privilege than Cloud Device Admin. License admin is correct

Correct!

As stated in the FAQs in this doc: https://msft.it/61696cDu6p the minimum role-based access control (RBAC) rights required to access the recovery key in the Intune console is Helpdesk Administrator.

I think I agree with this. Cloud Device Admin would allow disabling and deleting of devices from Entra ID. Helpdesk Admin would therefore by least privileged as it can only reset passwords. Hard as is deleting accounts less privileged than password resets? Hmmm

The key here is Least privileged role. 1. Cloud Device Admin is least privileged for Bitlocker keys. 2. License Admin for usage location.

Cloud Device Admin is the least privilege role for viewing Bitlocker keys: https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/delegate-by-task

I guess Helpdesk Admin is less privileged than Cloud device admin

Are we sure that it's Helpdesk Administrator? Cloud Device Administrator: Users in this role can enable, disable, and delete devices in Microsoft Entra ID and read Windows 10 BitLocker keys (if present) in the Azure portal.

I think the first answer is a tossup between Intune Admin and HelpDesk Admin. Yes, if you compare them via the M365 admin portal, Intune Admin has more checkboxes, but could one argue that Intune Admin is less privilege since it's only scoped to devices? Agree with answer 2 - License Admin.

correct, see https://practical365.com/license-admin-role-and-other-improvements-in-azure-ad-administration/ for confirmation a license admin can set usage location in azure ad.

correct