An organisation needs a set of administrators who can do exactly one thing: read and update the mobile phone and office location attributes on user profiles. No built-in Microsoft Entra role matches this narrow capability, and the security team insists the administrators get nothing beyond these two attribute permissions. Which approach grants this precise capability with the least privilege?
- AAssign the built-in User Administrator role, which already includes permission to update user profile attributes for the targeted users.
- BPlace the administrators in a dynamic group and grant that group write access to the user objects through group membership rules.
- CAssign the built-in Directory Writers role, which permits editing of selected directory objects across the tenant.
- DCreate a custom Microsoft Entra role containing only the user property update permissions, then assign that custom role to the administrators. Correct
Why A is wrong: User Administrator does let holders edit profile attributes, which is why it looks sufficient, but it also grants account creation, deletion and password reset, far exceeding the two-attribute scope the team mandated.
Why B is wrong: Dynamic groups automate membership from attributes and do not confer directory write permissions at all, so this neither scopes nor grants the attribute editing the team requires.
Why C is wrong: Directory Writers sounds like a tidy fit because of its name, but it grants a broad fixed set of write actions across many object types rather than the two specific user attributes requested.
Why D is correct: Custom roles let you compose a role from individual directory permissions, so granting only the user property update actions delivers exactly the two-attribute capability with nothing extra, satisfying least privilege.