AZ-104 Manage Azure Identities and Governance Practice Question
You are responsible for managing Azure resources in a hybrid environment. Your on-premises Active Directory Domain Services (AD DS) is synced to Azure AD using Azure AD Connect. You need to ensure that administrative units (AUs) are used to delegate administration of specific groups of users to help desk staff. Which three of the following are true regarding administrative units in Azure AD? (Choose three.)
⚠ Common exam trap
Watch out — candidates often assume administrative units are available in all Azure AD editions (including Free) because they are a basic delegation feature, but in reality they require Azure AD Premium P1 or higher.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Administrative units can contain users, groups, and devices.
Administrative units (AUs) in Azure AD are containers that can hold users, groups, and devices, allowing you to delegate administrative permissions over a subset of resources. You can assign Azure AD roles scoped to an AU, which limits the role's permissions to only the members of that AU. Users synced from on-premises AD DS via Azure AD Connect can be added to AUs because they become Azure AD user objects after synchronization, making them eligible for AU membership.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Administrative units can contain users, groups, and devices.
Why this is correct
Administrative units are Azure AD containers designed to hold directory objects so that permissions can be scoped to a defined subset. They explicitly support users, groups, and devices, which makes it possible to delegate management of, for example, all devices in a specific branch office without affecting the rest of the tenant. This container-based scoping is the fundamental mechanism that enables granular delegated administration.
- ✗
An administrative unit can span multiple Azure AD tenants.
Why it's wrong here
Administrative units are strictly scoped to the tenant in which they are created; a tenant is a dedicated Azure AD instance and cannot share administrative units with another tenant. Cross-tenant management of users or groups requires separate mechanisms such as Azure AD B2B collaboration, external identity governance, or delegated administration through partner relationships. Attempting to create an administrative unit spanning multiple tenants is not supported by the directory model.
- ✓
You can assign Azure AD roles scoped to an administrative unit.
Why this is correct
Administrative units allow you to restrict the scope of Azure AD built-in or custom roles to just the objects inside that unit. For example, you could assign the Helpdesk Administrator role with a scope of a single administrative unit, limiting the assignee to reset passwords only for users in that unit rather than the whole tenant. This scoped role assignment is the core value of administrative units and is a fully supported feature.
- ✗
Administrative units are available in all editions of Azure AD, including Free.
Why it's wrong here
Administrative units are not available in the free edition of Azure AD; they require Azure AD Premium P1 or P2 licenses. Specifically, each administrator whose role is scoped to an administrative unit must hold a Premium license, otherwise the tenant cannot create or use them. The Free tier only supports tenant-wide role assignments, so the claim that administrative units are available in all editions is false.
- ✓
Users synced from on-premises AD DS can be added to administrative units.
Why this is correct
Users synced from on-premises Active Directory Domain Services via Azure AD Connect appear as cloud objects in Azure AD and can be added to administrative units just like cloud-only users. Adding a synced user to an administrative unit affects only Azure AD role scopes; it does not modify the on-premises directory or alter the user's synchronization behavior. This makes administrative units particularly useful for dividing hybrid users into departments or geographic areas for delegated support.
- ✗
Administrative units can be created only via the Azure portal and not via PowerShell.
Why it's wrong here
Administrative units can also be created and managed via Microsoft Graph PowerShell cmdlets (for example, the Microsoft Graph PowerShell SDK) and the Microsoft Graph REST API, in addition to the Azure portal. PowerShell enables automation of administrative unit lifecycle tasks, such as bulk creation and membership changes, which is impractical through the portal alone. Therefore, the statement that they can only be created via the portal is factually incorrect.
Go deeper
Related to this question
About these practice questions
This AZ-104 question is part of Courseiva's 1,049-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.