Exam MS-500 topic 1 question 64 discussion

HOTSPOT -
You have a Microsoft 365 E5 subscription linked to an Azure Active Directory (Azure AD) tenant. The tenant contains a user named User1 and multiple Windows
10 devices. The devices are Azure AD joined and protected by using BitLocker Drive Encryption (BitLocker).
You need to ensure that User1 can perform the following actions:
✑ View BitLocker recovery keys.
✑ Configure the usage location for the users in the tenant.
The solution must use the principle of least privilege.
Which two roles should you assign to User1 in the Microsoft 365 admin center? To answer, select the appropriate roles in the answer area.
NOTE: Each correct selection is worth one point.
Hot Area:

Suggested Answer:
Box 1: Helpdesk admin -
View BitLocker recovery keys.
Helpdesk Admins can read bitlocker metadata and key on devices
Note: One of the following should be enough:

Global admins -

Intune Service Administrators -

Security Administrators -

Security Readers -

Helpdesk Admins -

Box 2: User Administrator -
Configure the usage location for the users in the tenant.
The User Administrator can manage all aspects of users and groups, including resetting passwords for limited admins.
The User Administrator cam manage all user properties including User Principal Name

Update (FIDO) device keys -
Reference:
https://docs.microsoft.com/en-us/azure/active-directory/roles/permissions-reference