AZ-104 Practice Question 42: Administrative Unit Scope
Microsoft Azure Administrator Associate (AZ-104) · Test 5 · question 2 of 10
A university runs one Microsoft Entra tenant. The School of Business has its own IT team, and you must let that team:
1. Reset passwords and edit user properties for School of Business staff and students only, and 2. Start, stop, and resize the virtual machines in the School of Business Azure subscription.
Which approach satisfies both requirements?
Show answer and explanation
Answer:
Administrative units solve the first half exactly: they "restrict permissions in a role to any portion of your organization that you define", and Microsoft's own example is to "delegate the Helpdesk Administrator role to regional support specialists, so they can manage users only in the region that they support". The page even walks through this university scenario. But an administrative unit "can contain only users, groups, or devices" (it is a Microsoft Entra container, not an Azure resource scope), so managing virtual machines needs a separate Azure RBAC assignment (for example, Virtual Machine Contributor) on the subscription or resource group.
Option A is right up to its last clause. Entra directory roles and Azure RBAC are separate permission systems; an administrative unit never grants control-plane rights over Azure resources.
Option B walks into the trap the documentation calls out: "Adding a group to an administrative unit brings the group itself into the management scope of the administrative unit, but not the members of the group." A scoped User Administrator could rename that group or change its membership, but could not reset the passwords of its members. Users must be added to the unit directly.
Option C grants tenant-wide helpdesk rights over every account in the university, including other schools' and administrators' accounts. Conditional Access governs how a user signs in, not which objects an administrator may act upon.
Reference: Administrative units in Microsoft Entra ID