Microsoft 365 Endpoint Administrator Associate MD-102 Practice Question

Windows LAPS stores the local administrator password on the Microsoft Entra device object when the backup directory is set to Azure AD. The ability to read that password requires the microsoft.directory/deviceLocalCredentials/password/read permission. Of the default roles, Cloud Device Administrator and Intune Administrator include this action, but Cloud Device Administrator is the more narrowly scoped, device-focused role. Assigning this role lets technicians retrieve LAPS passwords without the wide-ranging permissions of Intune Administrator or Global Administrator. Security Reader lacks the required permission, so it cannot show the passwords.