Describe security, compliance, privacy, and trust in Microsoft 365 →hardMultiple Choice

MS-900 Practice Question: Describe security, compliance, privacy, and trust in Microsoft 365

Exhibit

Refer to the exhibit.
```json
{
  "roleName": "Global Reader",
  "permissions": [
    "microsoft.directory/domains/allProperties/read",
    "microsoft.directory/users/allProperties/read",
    "microsoft.directory/groups/allProperties/read"
  ]
}
```

An administrator is assigned the Global Reader role in Microsoft Entra ID as shown in the exhibit. What can this administrator do?

⚠ Common exam trap

Many candidates confuse the Global Reader role with the Global Administrator role, assuming it includes some write capabilities like password resets or user creation, but Microsoft strictly separates read-only and write roles in Entra ID.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

View all user and group properties in the directory

The Global Reader role in Microsoft Entra ID is a read-only role that allows viewing all directory settings, including user and group properties, but does not grant any write permissions. This enables the administrator to view but not modify user or group attributes, making option A correct.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
View all user and group properties in the directory
Why this is correct
The Global Reader role in Microsoft Entra ID is granted read-only permissions across directory objects, so a holder can view all user and group properties, including display names, job titles, and directory settings, without any write capability. Because Global Reader is designed as the read-only counterpart to Global Administrator, it can enumerate these properties for every user and group in the tenant but cannot modify them or perform management tasks.
✗
Reset user passwords
Why it's wrong here
Resetting a user's password is a write operation that changes the user's authentication credentials, which the Global Reader cannot perform. This task requires a role with delegated write permissions to authentication methods, such as Password Administrator, Authentication Administrator, Privileged Authentication Administrator, or Global Administrator. Global Reader's read-only scope intentionally excludes credential management, so the reset attempt would fail with an authorization error.
✗
Assign administrative roles to other users
Why it's wrong here
Assigning administrative roles modifies directory role membership, which is an administrative write action tracked by role management permissions. This requires the Privileged Role Administrator or Global Administrator role because those roles can update the members of other directory roles. The Global Reader role has no roleMembership write scope, so it cannot grant, revoke, or assign any administrative role to another user.
✗
Create new users in the directory
Why it's wrong here
Creating a new user in the directory requires the ability to write user objects, including supplying required attributes such as userPrincipalName and displayName and provisioning the account state. This write capability is held by User Administrator or Global Administrator, not by Global Reader. Since Global Reader only has read access to directory objects, creating users is outside its permitted actions and would be denied by the directory service.

Go deeper

MS-900 Practice Question: Describe security, compliance, privacy, and trust in Microsoft 365

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question