Question

Your organization has a single Microsoft Entra tenant with users from several regional offices. The IT team in the Berlin office must be able to reset passwords and manage properties only for users who belong to the Berlin office, without gaining any control over users in other offices. You want to grant this access using the least-privilege approach. What should you do?

Accepted Answer

Assign the Berlin IT team the User Administrator role scoped to an administrative unit that contains only the Berlin users.

Answer

Assign the Berlin IT team the Global Administrator role and instruct them to only manage Berlin users.

Answer

Create a dynamic security group of Berlin users and add the Berlin IT team as owners of that group.

Answer

Assign the Berlin IT team the User Administrator role at the tenant level.