AZ-104 Manage Azure Identities and Governance Practice Question
You need to ensure that all users in the HelpdeskAdmins group can reset passwords for cloud-only users in Microsoft Entra ID but cannot modify group memberships or delete users. Which role should you assign?
⚠ Common exam trap
A common mix-up: candidates confuse User Administrator with Helpdesk Administrator, assuming both can reset passwords, but User Administrator also grants broader user management capabilities like modifying group memberships and deleting users, which the question explicitly forbids.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Helpdesk Administrator
The Helpdesk Administrator role is specifically designed to allow password resets for non-administrator users (including cloud-only users) while explicitly preventing modifications to group memberships or deletion of users. This aligns perfectly with the requirement to restrict the HelpdeskAdmins group to only password reset capabilities.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Global Administrator
Why it's wrong here
Assigning Global Administrator grants unrestricted access to all Azure AD and Azure resources, including user management, billing, and tenant-wide configuration. This is a highly privileged role that would allow helpdesk users to modify conditional access policies, manage enterprise applications, and even elevate other administrators. It violates the least-privilege principle and exceeds the requirement of password resets by orders of magnitude.
When this WOULD be correct
A scenario where the requirement is to grant a user or group full administrative access to all aspects of Microsoft Entra ID, including user management, group management, and security settings, with no restrictions.
- ✗
User Administrator
Why it's wrong here
While the User Administrator role can reset passwords for users, it also has permissions to create and delete users, manage user licenses, and update user contact info and properties. It can also manage groups and roles except for Global Administrator. This broader scope makes it inappropriate for a helpdesk function focused solely on password resets, as it introduces unnecessary risk of unintended changes.
When this WOULD be correct
A question requiring a role that can reset passwords AND manage user accounts (e.g., create users, modify attributes) for cloud-only users, but not necessarily restrict group membership changes or deletions.
- ✓
Helpdesk Administrator
Why this is correct
This is the least-privileged built-in directory role explicitly designed for password resets and service request handling. It can reset passwords for non-admin users and manage service health, but cannot modify role assignments or manage MFA for privileged accounts. This aligns with Azure AD's principle of granular delegated administration, giving helpdesk staff precisely the rights needed without broader user or security management.
- ✗
Security Administrator
Why it's wrong here
The Security Administrator role is focused on security features such as managing Conditional Access, Identity Protection, and security alerts, rather than on password lifecycle tasks. It can read audit logs and manage security policies, but password reset is not its primary function, and it grants permissions that are not needed for basic helpdesk operations. Choosing this role would misalign the helpdesk's job duties with its assigned privileges.
When this WOULD be correct
A question requiring management of security-related tasks such as configuring conditional access policies, managing security defaults, or reviewing identity protection reports would make Security Administrator the correct role.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓Helpdesk AdministratorCorrect answer▾
Why this is correct
This is the least-privileged built-in directory role explicitly designed for password resets and service request handling. It can reset passwords for non-admin users and manage service health, but cannot modify role assignments or manage MFA for privileged accounts. This aligns with Azure AD's principle of granular delegated administration, giving helpdesk staff precisely the rights needed without broader user or security management.
✗Global AdministratorWrong answer — click to see why▾
Why this is wrong here
Global Administrator has full access to all Microsoft Entra ID features, including modifying group memberships and deleting users, which exceeds the required permissions for resetting passwords only.
★ When this WOULD be the correct answer
A scenario where the requirement is to grant a user or group full administrative access to all aspects of Microsoft Entra ID, including user management, group management, and security settings, with no restrictions.
Why candidates choose this
Candidates may mistakenly believe that password reset requires the highest privilege level, or they may not be aware of the more granular roles like Helpdesk Administrator that provide limited permissions.
✗User AdministratorWrong answer — click to see why▾
Why this is wrong here
User Administrator can reset passwords but also has permissions to modify group memberships and delete users, which exceeds the required scope of only resetting passwords for cloud-only users.
★ When this WOULD be the correct answer
A question requiring a role that can reset passwords AND manage user accounts (e.g., create users, modify attributes) for cloud-only users, but not necessarily restrict group membership changes or deletions.
Why candidates choose this
Candidates may confuse User Administrator with Helpdesk Administrator, assuming both only handle password resets, but User Administrator has broader user management capabilities.
✗Security AdministratorWrong answer — click to see why▾
Why this is wrong here
Security Administrator role manages security features like conditional access and identity protection, but does not include permissions to reset passwords for cloud-only users.
★ When this WOULD be the correct answer
A question requiring management of security-related tasks such as configuring conditional access policies, managing security defaults, or reviewing identity protection reports would make Security Administrator the correct role.
Why candidates choose this
Candidates may confuse password reset as a security function and assume the Security Administrator role includes it, not realizing that Helpdesk Administrator is the dedicated role for password resets.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Microsoft Entra ID Users and Groups
Key term
Microsoft Entra ID
Microsoft Entra ID is a cloud-based identity and access management service that lets employees sign in and access resources both inside and outside of your organization.
Key term
Group
A group is a collection of users, devices, or other objects that are assigned permissions and policies together for simplified management in identity and governance systems like Microsoft Entra ID.
About these practice questions
One of 1,049 original AZ-104 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.