How to Delegate Password Resets with the Password Administrator Role
An administrator is managing a Microsoft 365 tenant and needs to delegate the ability to reset user passwords to a group of helpdesk staff. The helpdesk staff should not have any other administrative privileges. Which built-in role should the administrator assign?
Quick Answer
The answer is the Password Administrator role. This built-in role is the correct choice because it grants the specific ability to reset passwords for non-administrator users and manage service requests, without providing broader administrative privileges like managing users, groups, or licensing, which perfectly aligns with the principle of least privilege when you need to delegate password reset only. On the Microsoft 365 Administrator MS-102 exam, this question tests your understanding of role-based access control (RBAC) and the distinction between narrowly scoped roles like Password Administrator and broader roles like Helpdesk Administrator, which also resets passwords but includes additional user management capabilities. A common trap is selecting Helpdesk Administrator because it also resets passwords, but that role adds unnecessary permissions. Remember the memory tip: “Password Admin is for passwords only—no user admin, no license control.”
⚠ Common exam trap
A common mix-up: candidates confuse the Helpdesk Administrator role (which also resets passwords) as the correct answer, but the Password Administrator role is even more restricted and specifically designed for password-only tasks, making it the precise least-privilege choice.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Password Administrator
The Password Administrator role is the correct choice because it grants the specific ability to reset passwords for non-administrator users and manage service requests, without providing broader administrative privileges like managing users, groups, or licensing. This aligns with the principle of least privilege, ensuring helpdesk staff can perform password resets without accessing other sensitive areas of the tenant.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Global Administrator
Why it's wrong here
Global Administrator has full access to all administrative features, too broad.
- ✓
Password Administrator
Why this is correct
Password Administrator can reset passwords for non-administrator users and does not include other administrative capabilities.
- ✗
User Administrator
Why it's wrong here
User Administrator can reset passwords but also manage user accounts and groups, which is more than required.
- ✗
Helpdesk Administrator
Why it's wrong here
Helpdesk Administrator can reset passwords but also manage support requests, adding extra privileges.
Go deeper
Related to this question
Learn chapter
Microsoft 365 Tenant Setup
Key term
Microsoft 365 tenant
A Microsoft 365 tenant is a dedicated, isolated instance of Microsoft 365 services created for an organization when they sign up for a subscription.
Key term
Access control
Access control is the security practice of determining who or what is allowed to view, use, or enter a resource, and under what conditions.
About these practice questions
Courseiva writes every MS-102 question from scratch — 241 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on MS-102
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. You need to delegate the ability to reset user passwords in Microsoft Entra ID to a helpdesk team. However, they should not be able to modify other user attributes. What role should you assign?
medium- A.User Administrator
- ✓ B.Helpdesk Administrator
- C.Global Administrator
- D.Password Administrator
Why B: The Helpdesk Administrator role is specifically designed to allow password resets and force password changes for non-administrator users and other helpdesk administrators, while explicitly preventing modifications to other user attributes like group membership or profile details. This role provides the least privilege necessary for the helpdesk team's task, aligning with the principle of role-based access control (RBAC) in Microsoft Entra ID.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MS-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MS-102 exam.