A company must guarantee that Helpdesk Administrators and even tenant-level Global Administrators cannot reset the passwords of C-level executive accounts or read their BitLocker keys, without stripping those admins of their tenant-wide roles. Only a small, explicitly designated set of administrators should be able to manage the executive accounts. Which Microsoft Entra capability meets this requirement?
Correct answer: B. A restricted management administrative unit containing the executive accounts, with a role scoped to that unit assigned only to the designated administrators
A restricted management administrative unit protects specific objects so that only administrators explicitly assigned a role at the scope of that unit can modify them. Even tenant-level Global Administrators and Privileged Role Administrators are blocked from modifying the objects unless they scope themselves to the unit, which is an auditable event. Placing the executive accounts in a restricted management administrative unit and assigning the trusted administrators a role (for example, Authentication Administrator) at that scope meets the requirement without removing anyone's tenant-wide roles.
Why the other options are wrong:
- A. Conditional Access governs sign-in access conditions, not which administrators may perform a password reset on an object. It cannot enforce this admin-scoping requirement.
- C. A regular (non-restricted) administrative unit narrows a scoped admin's reach, but it does not block tenant-level administrators. A Global Administrator, or a Helpdesk Administrator with tenant scope, could still reset the executives' passwords. Only a restricted management administrative unit blocks tenant-level admins.
- D. Privileged Role Administrator manages role assignments tenant-wide and does not restrict who can manage the executives' accounts. Assigning it to executives is both incorrect for the goal and a privilege-escalation risk.
Memory hook: Block even Global Admins from touching sensitive accounts, without removing their roles = Restricted Management AU. A regular AU does not stop tenant-level admins.
Microsoft Learn: Admin units restricted management