Microsoft Security, Compliance, and Identity Fundamentals SC-900 Practice Question

The User Administrator role is designed for day-to-day identity management tasks. Users with this role can create, read, update, and delete user accounts, manage group membership, and reset passwords for non-administrator accounts. They cannot elevate privileges, assign most admin roles, or manage Azure subscriptions, meeting the least-privilege requirement. The Password Administrator role only handles password resets and lacks user or group management rights. Global Administrator is overly broad, granting full tenant control. Billing Administrator is unrelated to identity management and focuses on subscription payment settings.