MS-102 Deploy and manage a Microsoft 365 tenant Practice Question
Your organization uses Microsoft 365 E5 licenses for all users. You need to configure role-based access control (RBAC) so that helpdesk staff can reset passwords and manage licenses, but cannot modify user principal names (UPNs) or delete users. Which role assignment should you use?
⚠ Common exam trap
Many candidates confuse the Helpdesk Administrator role with the User Administrator role, assuming the latter is required for license management, but User Administrator includes dangerous permissions like UPN modification and user deletion that are explicitly prohibited in the question.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Helpdesk Administrator
The Helpdesk Administrator role is correct because it grants the specific permissions needed to reset passwords and manage licenses, while explicitly preventing modifications to user principal names (UPNs) and user deletions. This role is designed for tier-1 support staff who require these capabilities without elevated user management rights.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
License Administrator
Why it's wrong here
The License Administrator role in Microsoft Entra ID is scoped exclusively to managing license assignments, including assigning, removing, and modifying licenses for users and groups, along with read-only access to directory information. It does not include any permission to perform password resets or other credential operations for users. Because the scenario requires both resetting a user's password and assigning a license, this role fails the password reset requirement even though it could handle the license portion, so it is incorrect.
- ✓
Helpdesk Administrator
Why this is correct
Helpdesk Administrator is the correct choice because Microsoft Entra ID grants this role the combined abilities to reset passwords for non-administrator users and to manage license assignments by including the License Administrator permission as part of its delegated scope. Critically, it explicitly excludes the more privileged User Administrator capabilities such as deleting users or modifying user principal names (UPNs), which aligns exactly with the stated restrictions. This makes Helpdesk Administrator the least-privileged built-in role that satisfies both required tasks without permitting the prohibited actions.
- ✗
Password Administrator
Why it's wrong here
Password Administrator is limited to resetting passwords for users in the directory, and in some cases can also disable or enable a user account, but it does not include any permission to manage Microsoft 365 licenses or any other directory write operations. Although this role fully covers the password reset requirement, it cannot assign or modify the user's license as required by the scenario. Therefore, a user holding only the Password Administrator role would be unable to complete the license assignment task, making it an invalid answer.
- ✗
User Administrator
Why it's wrong here
User Administrator is a broad administrative role that includes the ability to reset passwords and manage licenses, but it also grants the capability to create and delete users, modify user principal names (UPNs), and change other directory attributes. The scenario explicitly forbids deleting users or modifying UPNs, so this role is over-privileged and violates the stated security constraint even though it technically fulfills the license and password reset tasks. Because the requirement demands minimal necessary permissions and prohibits those destructive actions, User Administrator is incorrect.
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
Learn chapter
Named Locations and Network-Based Policies
Key term
RBAC
RBAC is a method of restricting network access based on the roles of individual users within an organization, where permissions are assigned to roles rather than to individuals directly.
Key term
Microsoft 365
Microsoft 365 is a subscription-based cloud service from Microsoft that combines productivity tools like Office apps with security, device management, and online storage.
About these practice questions
Courseiva writes every MS-102 question from scratch — 712 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MS-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MS-102 exam.