Question
Your network contains an Azure Active Directory Domain Services (Azure AD DS) domain named contoso.com.
You need to configure a password policy for the local user accounts on the Azure virtual machines joined to contoso.com.
What should you do? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Explanation
Sign in by using a user account that is a member of the: AAD DC Administrators group. In an Azure AD DS (Microsoft Entra Domain Services) managed domain, Microsoft runs the domain controllers, and you do not get Domain Admins or Enterprise Admins rights. Members of the AAD DC Administrators group have Group Policy administration rights in the managed domain and can edit the built-in GPOs or create custom ones. Membership in Administrators or Domain Admins is not available to you for this purpose.
Use a Group Policy Object (GPO) linked to the: AADDC Computers organizational unit (OU). Password policy is an Account Policies setting under Computer Configuration. A domain GPO linked to an OU applies these settings to the local accounts of the computers in that OU. VMs joined to the managed domain are placed in the AADDC Computers container, which has its own built-in GPO where Account Policies can be customized. A GPO linked to AADDC Users would target user objects, where computer password settings have no effect. The Computers container is not where Azure AD DS places domain-joined VMs.
