mediumMultiple ChoiceObjective-mapped
Assign Least-Privileged Admin Roles for Support Staff
An administrator is reviewing a request from users who need to let support staff troubleshoot without tenant-wide change permissions. Microsoft 365 licensing, admin, or support concept is most relevant?
Quick Answer
Assigning a least-privileged role such as Helpdesk Administrator is the right approach because it grants support staff exactly the access needed to troubleshoot — resetting passwords, viewing user details — without extending tenant-wide change permissions that a broader admin role would carry. This is the principle of least privilege applied to Microsoft 365's built-in role structure: rather than making someone a Global Administrator because they need to help users, you match the role to the narrowest set of permissions the job actually requires. Microsoft 365 ships dozens of scoped admin roles precisely so this matching is possible without resorting to custom role definitions. On the exam, any scenario describing a request for limited or supervised access, rather than full administrative control, is testing recognition of built-in scoped roles like Helpdesk Administrator, User Administrator, or Global Reader — the specific role matters less than recognising that a narrower role, not the broadest one available, is always the intended answer.
⚠ Common exam trap
Many candidates confuse a specific Microsoft 365 service (like Stream, Forms, or Whiteboard) with an admin or support concept, failing to recognize that the question is about role-based access control and least privilege, not about a particular application.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Assign least-privileged support or reader roles
The scenario requires granting support staff the ability to troubleshoot without tenant-wide change permissions, which directly maps to the principle of least privilege. In Microsoft 365, this is achieved by assigning a role like Helpdesk Administrator or a reader role (e.g., Global Reader), which provides read-only or limited administrative access without allowing modifications to tenant-wide settings. This aligns with the 'Describe Microsoft 365 pricing and support' domain, specifically the support and admin concepts.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Microsoft Stream
Why it's wrong here
Stream hosts video content and does not address this licensing or support need.
- ✓
Assign least-privileged support or reader roles
Why this is correct
Support roles should be scoped to the minimum access needed.
- ✗
Microsoft Forms
Why it's wrong here
Forms collects survey responses and does not meet this requirement.
- ✗
Microsoft Whiteboard
Why it's wrong here
Whiteboard is for visual collaboration, not this licensing or admin requirement.
Go deeper
Related to this question
Learn chapter
Benefits of Microsoft Cloud
Key term
Tenant
A dedicated and isolated instance of Microsoft Entra ID that an organization receives when signing up for a Microsoft cloud service.
Key term
Microsoft 365
Microsoft 365 is a subscription-based cloud service from Microsoft that combines productivity tools like Office apps with security, device management, and online storage.
About these practice questions
Courseiva writes every MS-900 question from scratch — 217 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
3 more ways this is tested on MS-900
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. An administrator is reviewing a request from users who need to reset user passwords without assigning Global Administrator. Microsoft 365 licensing, admin, or support concept is most relevant?
medium- A.Microsoft Whiteboard
- ✓ B.Password Administrator
- C.Microsoft Forms
- D.Microsoft Stream
Why B: The Password Administrator role in Microsoft Entra ID (formerly Azure AD) allows users to reset passwords for non-administrator users and manage service requests without granting the highly privileged Global Administrator role. This directly addresses the user request while adhering to the principle of least privilege, making it the most relevant concept for this scenario.
Variation 2. While preparing a Microsoft 365 adoption plan, a consultant is asked to control who can purchase or change subscriptions. Microsoft 365 licensing, admin, or support concept is most relevant?
medium- A.Microsoft Whiteboard
- B.Microsoft Forms
- ✓ C.Admin roles and billing permissions
- D.Microsoft Stream
Why C: The question asks about controlling who can purchase or change subscriptions, which is a billing and licensing administration task. Admin roles and billing permissions in Microsoft 365 allow you to delegate specific permissions, such as the Billing Administrator role, which grants the ability to make purchases, manage subscriptions, and handle support tickets. This directly addresses the requirement to restrict subscription changes to authorized personnel.
Variation 3. While preparing a Microsoft 365 adoption plan, a consultant is asked to manage billing without granting full tenant control. Microsoft 365 licensing, admin, or support concept is most relevant?
medium- A.Microsoft Stream
- B.Microsoft Forms
- ✓ C.Billing Administrator
- D.Microsoft Whiteboard
Why C: The Billing Administrator role in Microsoft 365 is specifically designed to manage billing tasks—such as invoices, payment methods, and subscription purchases—without granting broader tenant-wide administrative privileges. This aligns directly with the scenario of managing billing while avoiding full tenant control, making it the most relevant concept for the adoption plan.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MS-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MS-900 exam.