Microsoft 365 Administrator Expert MS-102 Practice Question

The Helpdesk Administrator role (also shown as Password Administrator) allows its members to reset passwords and invalidate sign-in tokens for non-administrator users. When this role is assigned at the scope of an administrative unit, the permissions are limited to the users who are members of that AU. It does not permit creating or deleting user objects or managing groups, so it meets the stated restrictions.

User Administrator and Groups Administrator both allow user or group lifecycle changes that exceed the requirement. Authentication Administrator can force sign-outs but also lets members manage MFA methods, which is broader than needed here.