Deploy and manage a Microsoft 365 tenant →mediumMultiple Choice

MS-102 Deploy and manage a Microsoft 365 tenant Practice Question

Exhibit

Refer to the exhibit.
```json
{
  "roleName": "Custom Helpdesk",
  "permissions": [
    "microsoft.directory/users/standard/read",
    "microsoft.directory/users/password/update"
  ]
}
```

Refer to the exhibit. You are creating a custom role in Microsoft Entra ID for helpdesk staff. What can users assigned this role do?

⚠ Common exam trap

Test-takers frequently assume 'reset password' implies full user management or that reading user properties automatically includes reading groups, but Microsoft Entra ID separates these into distinct permission scopes.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Read user properties and reset passwords

The custom role shown in the exhibit includes only the 'Users' > 'Basic' > 'Read' permission and the 'Authentication' > 'Passwords' > 'Reset password' permission. This combination allows helpdesk staff to read basic user properties (such as display name, user principal name, and job title) and reset user passwords. It does not grant write access to other user attributes, security groups, or license assignments.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
Read user properties and reset passwords
Why this is correct
The exhibit's custom role permission list contains exactly two entries: 'Read user properties' and 'Reset passwords.' These permissions align precisely with the task of viewing a user's profile and resetting their password, with no extra administrative rights such as creating users or assigning licenses. Therefore, the role description 'Read user properties and reset passwords' accurately and completely reflects the configured permissions.
✗
Read security groups and reset passwords
Why it's wrong here
The role shown in the exhibit does not include a 'Read security groups' permission anywhere in its list. The two selected permissions are 'Read user properties' and 'Reset passwords,' so the role can view user directory properties but has no access to security group objects. Without the explicit group-read permission, any attempt to read security groups would fail, even though the password reset permission is present.
✗
Create new users and reset passwords
Why it's wrong here
The custom role's permissions do not contain 'Create new users.' The exhibit shows only read user properties and reset password rights, which are passive, account-maintenance permissions. Creating a new user requires the 'Create new users' permission in Microsoft Entra ID, and since it is absent from the role definition, this option cannot describe the role.
✗
Read user properties and assign licenses
Why it's wrong here
Assigning licenses is a separate permission that is not enabled in the role from the exhibit. The role contains 'Read user properties' and 'Reset passwords,' but no 'Assign licenses' permission, so a member could not perform license management tasks. Even though the read-user-properties half matches, the license-assignment half does not, making the option unsupported.

Go deeper

MS-102 Deploy and manage a Microsoft 365 tenant Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question