Exam MS-102 All Questions

View all questions & answers for the MS-102 exam

Exam MS-102 topic 1 question 162 discussion

Actual exam question from Microsoft's MS-102

Question #: 162
Topic #: 1

HOTSPOT
-

You have a Microsoft 365 E5 subscription that contains the users shown in the following table.

You create an administrative unit named AU1 that contains the members shown in the following exhibit.

The User Administrator role has the assignments shown in the following exhibit.

For each of the following statements, select Yes if the statement is true. Otherwise, select No.

NOTE: Each correct selection is worth one point.

Show Suggested Answer

Suggested Answer:

by Ranger_DanMT at Oct. 3, 2023, 3:43 p.m.

Comments

Submit Cancel

aleksdj

Highly Voted 1 year ago

YES User1 can reset password of User3 because User1 is User Administrator Organization and User3 is direct member of AU1 which is inside Scope Organization YES User2 can reset password of User3 because User2 is member of Group2 and Group2 has assigned role for User Administrator for Scope AU1, User3 is direct user member of AU1 NO User2 can NOT reset password of User1 because both User2 and User1 are member of a role-assignable group and you cannot change a password of user in a role-assignable group

upvoted 18 times

fabiomartinsnet

2 months, 3 weeks ago

Key Rule of Administrative Units (AUs) in Microsoft Entra ID: An Administrative Unit (AU) restricts role assignments to apply only to the users within that AU. However, the administrator (User02) must also be a member of the AU for the role to take effect. Since User02 is NOT a member of Administrative Unit 01, the User Administrator role within the AU does not apply to any user of AU1.

upvoted 1 times

...

OHMSS

4 months, 4 weeks ago

Yes they can https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/privileged-roles-permissions?tabs=admin-center#who-can-reset-passwords

upvoted 1 times

ca7859c

2 months ago

Under the User Adminstrator role: Users with this role cannot do the following: Cannot manage MFA. Cannot change the credentials or reset MFA for members and owners of a role-assignable group. Cannot manage shared mailboxes. Cannot modify security questions for password reset operation.

upvoted 1 times

...

VikC

Highly Voted 1 year, 2 months ago

Y/Y/N User Administrator Cannot change the credentials or reset MFA for members and owners of a role-assignable group, and User2 is a member of a role assigned group. https://learn.microsoft.com/en-us/azure/active-directory/roles/permissions-reference#user-administrator

upvoted 15 times

NrdAlrt

1 year, 1 month ago

Good point, thanks.

upvoted 1 times

...

[Removed]

1 year ago

by your logic then user 2 would also be no

upvoted 4 times

...

Ruslan23

Most Recent 1 month, 2 weeks ago

Y Y N Logically for security reason User2 cannot change the password of User1 because he could gain the same access on Organization level instead of AU1 only.

upvoted 1 times

...

TonyManero

8 months ago

Y/Y/N Here the point is that: User 2 in an Admin only of the AU scope, so cannot reset password for users out of the scope.

upvoted 4 times

...

Tomtom11

9 months, 2 weeks ago

https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/permissions-reference#user-administrator Users with this role cannot do the following: Cannot manage MFA. Cannot change the credentials or reset MFA for members and owners of a role-assignable group. Cannot manage shared mailboxes.

upvoted 1 times

...

Ranger_DanMT

1 year, 2 months ago

I think this is the correct answer, the only "no" anwer would be if User 3 could reset the password of user 1 or user 2.

upvoted 3 times

...