Exam SC-300 topic 1 question 62 discussion

https://learn.microsoft.com/en-us/microsoft-365/admin/add-users/admin-roles-page#compare-roles

The answer is C. https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/permissions-reference Microsoft 365 admin center doesn't have Application Administrator role

I am really surprised that the Entra Id Admin Center would not have this capability but the answer is surprisingly the M365 Admin Portal.

To compare the role permissions of each user in your Azure AD tenant with minimal administrative effort, you should use the Microsoft Entra admin center (Option C). The Microsoft Entra admin center is specifically designed to manage and monitor your Microsoft Entra ID (formerly known as Azure Active Directory). It allows you to view and manage user roles and permissions efficiently.

Just tested in my tenant. You can choose the THREE roles to compare them. :-)

Option B: the Microsoft 365 admin center is primarily used for managing Microsoft 365 services, such as users, groups, licenses, and basic security settings. However, it does not provide detailed insights into Azure AD role permissions or allow for a direct comparison of role permissions assigned to users. To specifically compare and manage Azure AD roles and permissions, Microsoft Entra admin center (Option C) is the correct tool, as it focuses on identity and access management within Azure AD. Therefore, while Option B allows for some user and role management, it does not meet the requirement to compare detailed role permissions in Azure AD. Option C is more suitable for this task.

The correct answer is B. the Microsoft 365 admin center. The Microsoft 365 admin center provides a centralized location where you can view and manage the role permissions of each user in your Azure AD tenant. This will allow you to easily compare the permissions of Admin1, Admin2, and Admin3, thus minimizing administrative effort. The other options do not provide this specific functionality.

If you dont include the answer choices: You should use the Azure Active Directory (Azure AD) Privileged Identity Management (PIM). Azure AD PIM provides a consolidated view of the role assignments across your organization, and it makes it easy to see who has what permissions. If you include the answer options given: B. the Microsoft 365 admin center. The Microsoft 365 admin center provides a consolidated view of the role assignments across your organization, and it makes it easy to see who has what permissions. This solution minimizes administrative effort as it provides a centralized view and management of role assignments. Please note that the other options: A. the Microsoft 365 Defender portal is primarily used for managing security threats. C. the Microsoft Entra admin center does not exist. D. the Microsoft Purview compliance portal is used for data governance and compliance, not for managing user roles and permissions.

Microsoft 365 admin center

https://learn.microsoft.com/en-us/microsoft-365/admin/add-users/assign-admin-roles?view=o365-worldwide#compare-roles You can now compare permissions for up to 3 roles at a time so you can find the least permissive role to assign. In the admin center

B is correct answer!

So it is B because it actually has a “compare roles” button to compare up to 3 roles with. So the question is not about actually comparing roles, but where the menu option is to do it the MS way. More certification trivia!

B. Testing we can see all role in both admin centers but 0365 admin has the option to "compare" roles.

All 3 accounts are listed with role permissions in both portals. Since Entra is the place for ID management, the MS answer would be C. Also, the m365 portal lists the name of each permission not the actual syntax for each user right. Again, this supports the MS answer.

I think there's a similar question in MS-102 and answer is M365 admin

Looking at the current state (03.01.24) we have the roles available in both B and C! MS 365 Admin center - Application Administrator: Create and manage enterprise application, registrations, and proxy settings, excluding Microsoft Graph and Azure AD Graph Consent to delegated permissions and application permissions MS Entra Admin Center - Application Adminstrator: Users in this role can add, manage, and configure enterprise applications, app registrations and manage on-premises like app proxy. There's also no difference in the remaining roles, however thinking in the MS world, I still would go for C!

Application Administrator not visible on M365 site