Task 1.1: Configure and manage a Microsoft Entra tenant

• ASet "Restrict non-admin users from recovering the BitLocker key(s) for their owned devices" to Yes

  Correct

  It blocks self-service key access for owners who lack the BitLocker read permission, while roles such as Helpdesk Administrator keep reading keys.

• BSet "Registering user is added as local administrator on the device during Microsoft Entra join" to No

  Incorrect

  It changes only the device's local Administrators group; the employee stays the registered owner and can still read the key.

• CSet "Users may join devices to Microsoft Entra ID" to Selected, with only the help desk group selected

  Incorrect

  Employees could no longer join their new laptops themselves, which the stem requires them to keep doing.

• DSet "Save BitLocker recovery information to Microsoft Entra ID" to Disabled in the Intune BitLocker policy

  Incorrect

  New recovery keys would no longer reach Microsoft Entra ID, so the help desk couldn't read them there either.

A device's registered owner can view and copy its BitLocker keys, as can roles such as Cloud Device Administrator, Helpdesk Administrator, Intune Administrator, Security Administrator and Security Reader. The device setting "Restrict non-admin users from recovering the BitLocker key(s) for their owned devices" removes the owners' self-service access without changing ownership or the join settings; updating it needs at least the Privileged Role Administrator role.

• AAssign Helpdesk Administrator to the help desk a second time, with the Paris-Staff group itself as the assignment scope

  Incorrect

  A role scoped to a group grants permissions over the group object; it doesn't extend to the group's members.

• BChange the administrative unit to dynamic membership with a rule that selects users whose city is Paris

  Correct

  Users matched by the rule become direct members of the unit, so scoped admins can reset their passwords and new hires are added automatically.

• CAdd each Paris employee to the administrative unit as a direct member as they're hired

  Incorrect

  Direct user membership works, but it's the per-hire manual step the scenario rules out.

• DCreate a child administrative unit for Paris users under the existing Paris unit

  Incorrect

  Administrative units can't be nested.

A group in an administrative unit brings only the group into the unit's scope, not its members. Scoped administrators can manage the users' properties and passwords only when the users are members of the unit, and a rule for dynamic membership adds and removes them automatically.

• AThe built-in Application Administrator role, assigned with the Payroll-API app registration as the only scope

  Incorrect

  The built-in role covers every property of the app, including redirect URIs, owners and permissions.

• BA custom role with only microsoft.directory/applications/credentials/update, scoped to Payroll-API

  Correct

  A custom role can carry only the credentials permission and be assigned to a single app registration.

• COwnership of the Payroll-API app registration

  Incorrect

  An owner can manage all of the app registration's properties, not only its credentials.

• DApplication Developer, assigned at tenant scope

  Incorrect

  It grants nothing on an existing app registration that the user doesn't own.

Custom Microsoft Entra roles are built from the same permissions as built-in roles and can be assigned at an object scope such as one app registration. A role holding only microsoft.directory/applications/credentials/update, assigned to Payroll-API, gives exactly credential management on that app.

• ARun ForceDelete on litware.com from the Azure portal for the 600 users and the app

  Incorrect

  ForceDelete renames references to the initial onmicrosoft.com domain and, from the portal, disables the affected accounts.

• BMake contoso.com the primary domain for the users, then delete litware.com

  Incorrect

  Changing the primary domain doesn't rename existing users, so the deletion is still blocked.

• CRemove the litware.com verification TXT record from the DNS zone, then delete the domain

  Incorrect

  The DNS record isn't what blocks deletion; the references from users and the app are.

• DMove every user, group and app reference to contoso.com first, then delete litware.com

  Correct

  A domain can be deleted once no user, group or app references it, and the users keep contoso.com names.

Microsoft Entra ID refuses to delete a domain that any user name, email or proxy address, group address or app ID URI still uses. ForceDelete exists but renames references to the onmicrosoft.com domain and disables affected accounts in the portal, so here the references are moved to contoso.com first.

• AGlobal Administrator

  Incorrect

  It can manage domains but grants far more than needed.

• BDomain Name Administrator

  Correct

  It's the least privileged role for managing domain names.

• CUser Administrator

  Incorrect

  User Administrator manages users and groups, not domains.

• DHybrid Identity Administrator

  Incorrect

  This role manages hybrid identity components, not custom domain names.

Microsoft documents Domain Name Administrator as the least privileged role required to manage domains in Microsoft Entra ID, including adding, verifying and deleting custom domain names.

• AA new TXT record for europe.contoso.com at the DNS host

  Incorrect

  A TXT record is needed only when the subdomain is verified in a different tenant from its root.

• BAn MX record that points europe.contoso.com to Exchange Online for verification

  Incorrect

  MX records are a verification option for new root domains, and aren't needed here.

• CNothing: the subdomain is verified automatically because its root is verified

  Correct

  Microsoft Entra ID verifies a subdomain of a verified root automatically.

• DA support request to Microsoft to link the subdomain

  Incorrect

  Subdomain verification needs no support case.

When you add a subdomain such as europe.contoso.com after its root domain is added and verified, Microsoft Entra ID verifies the subdomain automatically. Verifying a subdomain in a different tenant from its root prompts for a TXT record.

• Afabrikam.com

  Incorrect

  A verified managed custom domain can be the primary domain.

• Blitware.com

  Incorrect

  A verified managed custom domain can be the primary domain.

• Ccontoso.com

  Correct

  A federated domain can't be the primary domain.

• Dcontoso.onmicrosoft.com

  Incorrect

  The initial domain is the primary domain when a tenant is created and can be set again.

You can change the primary domain to any verified custom domain that isn't federated. Changing the primary domain doesn't change existing users' names; it sets the default domain for new users.

• AOrganizational Branding Administrator

  Correct

  It's the minimum role required to customize company branding.

• BGlobal Administrator

  Incorrect

  It can customize branding but grants far more than needed.

• CGlobal Reader

  Incorrect

  Global Reader can view settings but can't change branding.

• DApplication Administrator

  Incorrect

  This role manages applications, not the tenant's sign-in branding.

Company branding customizes the default sign-in experience with logos, backgrounds, header, footer and custom CSS. The Organizational Branding Administrator role is the minimum role required to customize it, and adding custom branding needs a license such as Microsoft Entra ID P1 or P2.