Question
You have an Azure Active Directory Domain Services (Azure AD DS) domain.
You create a new user named Admin1.
You need Admin1 to deploy custom Group Policy settings to all the computers in the domain. The solution must use the principle of least privilege.
What should you include in the solution? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Explanation
Add Admin1 to the following group: AAD DC Administrators — In an Azure AD DS managed domain, Microsoft owns and operates the domain controllers, so no tenant account can ever join the true Domain Admins or Enterprise Admins roles; AAD DC Administrators is the delegated administrative group Azure AD DS provides, and it grants exactly the rights needed to manage the two built-in GPOs and the AADDC organizational units. Domain Admins and Group Policy Creator Owners are not available for membership changes in a managed domain, so neither can be used to delegate this task.
Instruct Admin1 to apply the custom Group Policy settings by: Modifying AADDC Computers GPO — Azure AD DS pre-creates the AADDC Computers and AADDC Users GPOs linked to the corresponding OUs, and every domain-joined machine is placed in the AADDC Computers OU, so editing that GPO applies the custom settings to all computers in the domain and is the least-privileged option available to a member of AAD DC Administrators. Creating a new GPO and linking it to the domain root is not possible because AAD DC Administrators lacks link and create rights at the domain level, and the Default Domain Policy is managed by the service and cannot be modified by tenant administrators.
