Exam AZ-500 topic 2 question 49 discussion

It was in Exam

Correct

Answer: B, Global administrator Reason: To modify Azure AD Connect synchronization options, even for domain administrators of the on-premises Active Directory, a Global administrator role in Azure AD is required. This is because changing sync configurations affects the entire Azure AD tenant and requires the highest level of privileges. While this might seem to conflict with the principle of least privilege, it is the minimum required role that can modify Azure AD Connect settings. Reference: https://learn.microsoft.com/en-us/azure/active-directory/hybrid/reference-connect-accounts-permissions#azure-ad-global-administrator

To support the answer: While the Global Administrator role is needed for setup and major changes, for ongoing synchronization tasks, Azure AD Connect uses a special service account. This account is granted the Directory Synchronization Accounts role, which has limited permissions specifically for performing directory synchronization tasks It's important to note that after the initial setup, you can reduce the privileges of the account used for day-to-day synchronization operations. However, any significant changes to the synchronization configuration will still require Global Administrator permissions. Answer: B in this case.

B. Global administrator

B. Global administrator OUTDATED

This is an old question. The new role for least privileged is: Hybrid Identity Administrator on the newer versions of AAD. But in this question, B is correct.

B is correct answer.

B is correct answer.

#exam question # 29 Sep

## Exam Question - 17 Sept 2021 ##

Azure AD Global Admin credentials These credentials are only used during the installation and are not used after the installation has completed. It is used to create the Azure AD Connector account used for synchronizing changes to Azure AD. The account also enables sync as a feature in Azure AD.

Azure AD Global Administrator account: used to create the Azure AD Connector account and configure Azure AD. You can view global administrator accounts in the Azure portal. See List Azure AD role assignments.

Confirm.