AZ104-Q: assign a directory-only administrator
A help-desk lead must reset users’ passwords but must not manage Azure resources. What should be assigned?
- A) Owner at the subscription scope.
- B) The least-privileged Microsoft Entra built-in directory role that permits password reset. ✓
- C) Contributor on every resource group.
- D) A storage-account access key. Answer: B. Entra directory roles administer identity functions; Azure RBAC roles administer Azure resources. Why not the others: The alternatives are excessive or unrelated to directory administration.