What's changed: Created MS-102 Chapter 1 (domain: Deploy and manage a Microsoft 365 tenant): tenant and service management (tenant creation, domain DNS TXT verification, org settings, Service Health/notifications, Network connectivity insights, software updates, Microsoft 365 Backup, adoption/usage), users and groups (Entra ID users/external B2B guests/contacts, Microsoft 365 Groups/security groups/shared mailboxes, group-based licensing, Microsoft Graph PowerShell bulk management), and roles and role groups (Entra roles/workload role groups, administrative unit delegation, PIM Just-In-Time elevation).
1.3Roles and role groups
Understand Microsoft 365 and Microsoft Entra ID roles, workload permissions for Defender XDR/Purview via role groups, delegation with administrative units, and Just-In-Time elevation of Entra roles via Privileged Identity Management (PIM).
Assign admin rights with least privilege. Use Entra roles, workload-specific role groups, delegation, and Just-In-Time elevation appropriately.
1.3.1Roles and workload permissions
Microsoft Entra ID roles (Global Administrator, User Administrator, Password Administrator, etc.) represent tenant-wide admin rights. Assign the least role needed for the job to avoid privilege concentration. Workloads such as Defender XDR and Microsoft Purview often manage permissions via their own role groups (sets of permissions), delegated on a layer separate from Entra roles.
1.3.2Delegation with administrative units
Administrative units bundle users/groups as a scope and delegate admin rights to that scope only (e.g., grant a regional admin password-reset rights for "users in West Japan" only). Unlike tenant-wide grants, the key is limiting the scope.
1.3.3Just-In-Time elevation via PIM
Privileged Identity Management (PIM) assigns privileged roles as eligible rather than permanent, letting users activate with a time limit when needed (Just-In-Time). Activation can require approval, MFA, and justification, reducing standing privilege. Different in purpose from administrative units (scope delegation): PIM’s key is minimizing privilege over time.
Cues: "tenant-wide admin rights" = Entra role (least privilege). "Defender/Purview workload permissions" = that workload’s role groups. "delegate to a specific subset of users" = administrative units. "elevate privilege only when needed, time-bound (JIT)" = Privileged Identity Management (PIM).
Watch the mix-ups: (1) Entra roles (tenant-wide) vs workload role groups (Defender/Purview). (2) Administrative units (scope delegation = over whom) vs PIM (time minimization = when to elevate)—different purposes. (3) Avoid permanent Global Administrator; use PIM eligible + JIT.
1.3.4Section summary
- Entra roles are tenant-wide, assigned least-privilege; Defender/Purview use workload role groups
- Administrative units delegate management to a specific scope of users/groups
- PIM elevates privilege as eligible + Just-In-Time, reducing standing access
Sign in to track progress — Log in.
Quick check
(just a quick review)Q1. You want to delegate password-reset rights to a regional admin for users in one region only, not others. Best?
Q2. You want privileged roles not permanently assigned, but elevated only when needed, time-bound, with approval and MFA. Best?
Q3. You want to give help desk minimal tenant-wide user management (create, reset password). Best?
Q4. You want to give SecOps only the permissions needed for Microsoft Defender XDR incident investigation. Best?
Q5. An audit flagged too many always-on Global Administrator accounts. Best way to reduce standing privilege?