SC-900 Describe the capabilities of Microsoft Entra Practice Question
A multinational organization uses Microsoft Entra ID. The IT help desk team is responsible for password resets and group management, but only for users located in the European region. The organization has created a group containing all European user accounts. Which Microsoft Entra feature should an administrator use to delegate these administrative tasks specifically to the help desk team, limited to the European user scope?
⚠ Common exam trap
A common mix-up: candidates confuse delegation of administrative tasks with end-user self-service features (SSPR) or access control policies (Conditional Access), failing to recognize that Administrative Units are the dedicated Microsoft Entra feature for scoped role-based delegation.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Administrative units
Administrative units (AUs) in Microsoft Entra ID allow administrators to delegate administrative permissions scoped to a specific subset of users, groups, or devices. By creating an AU containing only the European user group, the administrator can assign the help desk team roles (e.g., Helpdesk Administrator or User Administrator) limited to that AU, ensuring they can perform password resets and group management only for European users.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Administrative units
Why this is correct
Administrative units allow scoping of administrative roles (e.g., Helpdesk Administrator) to a specific subset of users, such as those in a particular region or department. This feature directly meets the requirement to delegate tasks limited to European users.
- ✗
Access reviews
Why it's wrong here
Access reviews are a Microsoft Entra ID Governance feature designed to ensure that users and groups maintain appropriate access rights over time. They facilitate periodic attestation and recertification of existing access, helping organizations enforce the principle of least privilege and meet compliance requirements. However, access reviews do not provide the mechanism for initially delegating administrative roles or permissions to a help desk team to manage a specific subset of users.
- ✗
Conditional Access
Why it's wrong here
Conditional Access policies are powerful security tools within Microsoft Entra ID that enforce access controls based on specific conditions, such as user location, device state, or sign-in risk. These policies determine how and when users can access applications and data, for example, requiring multi-factor authentication from untrusted locations. They are not designed for, nor do they provide, the capability to delegate administrative permissions or roles to manage other users or objects within the directory.
- ✗
Self-service password reset (SSPR)
Why it's wrong here
Self-service password reset (SSPR) is a user-centric feature that allows end-users to securely reset their own forgotten passwords or unlock their accounts without requiring intervention from IT support staff. While SSPR significantly reduces the burden on help desks by empowering users, it is a direct user capability. It does not involve delegating administrative permissions or roles to a help desk team to manage other users' passwords or profiles.
Go deeper
Related to this question
Learn chapter
Microsoft Entra ID
Key term
Group
A group is a collection of users, devices, or other objects that are assigned permissions and policies together for simplified management in identity and governance systems like Microsoft Entra ID.
Key term
Scope
In IT, scope defines the boundaries, goals, and deliverables of a project, assessment, or engagement, specifying what is included and what is excluded.
About these practice questions
One of 1,250 original SC-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.