Question
You have a Microsoft Entra Domain Services domain named contoso.com.
You need to provide an administrator with the ability to manage Group Policy Objects (GPOs). The solution must use the principle of least privilege.
To which group should you add the administrator?
- A. AAD DC Administrators Correct
- B. Domain Admins
- C. Schema Admins
- D. Enterprise Admins
- E. Group Policy Creator Owners
Explanation
In Microsoft Entra Domain Services, Microsoft manages the domain controllers, and customers do not get Domain Admins, Enterprise Admins, or Schema Admins rights in the managed domain. Members of the AAD DC Administrators group have Group Policy administration privileges in the managed domain. They can edit the built-in AADDC Users and AADDC Computers GPOs and create custom GPOs and OUs. Administering Group Policy requires signing in with an account in that group. Adding the administrator to AAD DC Administrators is therefore the least privileged supported way to let them manage GPOs. Group Policy Creator Owners is not the documented mechanism for GPO administration in a managed domain.
