Exam AZ-500 topic 2 question 121 discussion

I go with D https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/permissions-reference https://learn.microsoft.com/en-us/entra/permissions-management/product-privileged-role-insights Microsoft recommends that organizations have two cloud-only emergency access accounts permanently assigned the Global Administrator role. These accounts are highly privileged and aren't assigned to specific individuals. So I would say Global Administrator role is highly privileged.

Review highly privileged roles or Review service principals to review information on principal role assignments for the following roles: Application Administrator, Cloud Application Administrator, Exchange Administrator, Intune Administrator, Privileged Role Administrator, SharePoint Administrator, Security Administrator, User Administrator. https://learn.microsoft.com/en-us/entra/permissions-management/product-privileged-role-insights

✅ Global Administrator (Admin1) → Full control over all settings in the tenant, highest privilege. ✅ Privileged Role Administrator (Admin2) → Manages role assignments and elevated access for other administrators. ✅ Privileged Authentication Administrator (Admin3) → Manages authentication-related policies and security configurations. 🚫 Exchange Administrator (Admin4) is not considered a highly privileged role in this context. While it has control over Exchange Online, it does not manage tenant-wide security or role assignments, so it is excluded from the highly privileged roles list.

All except from Exchange admin have the Privileged tag in the Roles and Administrators blade of Entra ID.

for sure

for sure

Tested in Lab: d is correct ans.

This learn doc has an obvious label that says "Privileged" next to those roles that are Highly Privileged. Exchange Administrator doesn't have the "Privileged" label but the other 3 do. The answer is 100% without doubt D. https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/permissions-reference

Global Administrator role is highly privileged but not exchange admin.

the Insights tab in the Microsoft Entra Permissions Management portal focuses on users assigned to specific highly privileged roles. These roles include: Application Administrator Cloud Application Administrator Exchange Administrator Intune Administrator Privileged Role Administrator SharePoint Administrator Security Administrator User Administrator

D exchange not privileged role global admin priviliged

https://learn.microsoft.com/en-us/entra/permissions-management/product-privileged-role-insights#view-information-in-the-microsoft-entra-insights-tab

Exchange is not a privileged role For list of roles /privileged roles https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/permissions-reference

According to copilot In the Microsoft Entra Permissions Management Portal, some of the highly privileged roles include: Global Administrator: This role has access to all administrative features in Microsoft Entra and other Microsoft services. Privileged Role Administrator: Manages role assignments in Microsoft Entra, including the ability to assign and remove roles. Security Administrator: Has permissions to manage security-related features and settings. Exchange Administrator: Manages mail settings and features in Exchange Online. SharePoint Administrator: Manages SharePoint Online settings and features. Intune Administrator: Manages devices and applications through Microsoft Intune. Application Administrator: Manages application registrations and enterprise applications. Cloud Application Administrator: Manages cloud applications and their settings. User Administrator: Manages user accounts and groups https://learn.microsoft.com/en-us/entra/permissions-management/product-privileged-role-insights

From https://learn.microsoft.com/en-us/entra/permissions-management/product-privileged-role-insights#view-information-in-the-microsoft-entra-insights-tab Select Review highly privileged roles or Review service principals to review information on principal role assignments for the following roles: Application Administrator, Cloud Application Administrator, Exchange Administrator, Intune Administrator, Privileged Role Administrator, SharePoint Administrator, Security Administrator, User Administrator. So, answer is: C (Admin2 and Admin4 only)