In Microsoft Entra ID (formerly Azure Active Directory), roles are assigned to users to delegate administrative permissions in a least-privilege manner. The User Administrator role allows a user to manage other users and groups - for example, creating and managing user accounts, resetting passwords for non- administrators, and managing user group memberships.
To assign a role such as User Administrator, you must use the Directory role blade within the user's account properties in the Azure portal.
Step-by-step according to Microsoft documentation:
* Sign in to the Azure Portal using an account that has one of the following roles:
* Global Administrator
* Privileged Role Administrator
* Navigate to Azure Active Directory # Users # select AdminUser1.
* Under Manage, select Directory role.This blade shows all current role assignments for the selected user.
* Click Add assignment (or Modify role).
* Select the User Administrator role from the list of available directory roles, then click Add.
Once this is completed, AdminUser1 will have administrative permissions limited to user management activities within the tenant.
Why other options are incorrect:
* A. From the Groups blade, invite the user account to a new group:Group membership does not grant directory-level administrative permissions. Roles must be assigned at the directory role level, not via groups (unless using role-assignable groups configured for PIM).
* C. From the Licenses blade, assign a new license:Licenses determine service usage (e.g., Microsoft 365, Intune) and do not provide administrative privileges in Entra ID.
Extract from Microsoft Azure Administrator Documentation (Official Guide):
"To assign a role to a user, in the Azure portal, select the user, then under Manage select Directory role, and choose the role you want to assign." (Source: Microsoft Learn - Assign roles to users in Azure Active Directory)