Question

Contoso has offices in three regions. The IT director wants regional helpdesk staff to reset passwords only for users in their own region, without granting them any control over users in other regions. Each region's users are already members of a dynamic group based on their department attribute. What is the most appropriate way to delegate this permission using the least privilege?

Accepted Answer

Create an administrative unit for each region, add the region's users to it, and assign the helpdesk team the Password Administrator role scoped to that administrative unit.

Answer

Assign each regional helpdesk team the Password Administrator role at the tenant level and instruct them to only manage their own region's users.

Answer

Create a custom role with password reset permissions and assign it at the tenant level to each regional helpdesk team.

Answer

Assign each regional helpdesk team the Global Administrator role and rely on Conditional Access to restrict their access to their region.