Question

Contoso has a large Microsoft 365 tenant. The IT director wants regional help desk staff in the Berlin office to reset passwords and manage only the user accounts belonging to the Berlin region, without granting them the ability to manage users in any other region. All Berlin users share a common department attribute value. What should you implement to meet this requirement with the least administrative effort?

Accepted Answer

Create an administrative unit with dynamic membership based on the department attribute, then assign the Helpdesk Administrator role scoped to that administrative unit.

Answer

Assign the Berlin help desk staff the Password Administrator role at the tenant level.

Answer

Create a Microsoft 365 group containing all Berlin users and grant the help desk staff the Owner role on that group.

Answer

Make the Berlin help desk staff eligible for the Global Administrator role in Privileged Identity Management.