An administrator must grant a user the ability to manage users and groups in the directory, but not to manage any virtual machines. Which role-based access control system controls access to those directory resources?
- AAzure roles, which control access to Azure resources such as virtual machines through Azure Resource Manager.
- BMicrosoft Entra roles, which control access to directory resources through Microsoft Graph. Correct
- CNetwork security groups, which control inbound and outbound traffic to Azure resources.
- DConditional Access policies, which control the conditions under which a sign-in is allowed.
Why A is wrong: Azure roles control Azure resources such as virtual machines through Azure Resource Manager, not directory resources such as users and groups.
Why B is correct: Correct. The grounding states Microsoft Entra roles control access to Microsoft Entra resources such as users, groups, and applications using the Microsoft Graph API, whereas Azure roles control access to Azure resources such as virtual machines using Azure Resource Management.
Why C is wrong: Network security groups filter network traffic to Azure resources and do not grant administrative permissions over directory users and groups.
Why D is wrong: Conditional Access governs the conditions of a sign-in, not which administrative permissions a user holds over directory users and groups.