In Azure AD, password resets and session invalidation for non-administrative users are delegated with the least privilege by assigning the Helpdesk administrator (formerly Password administrator) role. The SC-300 materials explain that this role can reset passwords for standard users, force password change at next sign-in, require re-register for MFA, and revoke refresh tokens (invalidate sessions). The Authentication administrator has broader reach, including managing some authentication methods and affecting certain admin roles, which exceeds the minimum needed. Privileged Authentication Administrator can reset passwords for most admin roles (beyond the scope here) and is therefore not least-privileged. Security administrator focuses on configuring and viewing security features, not resetting user passwords. To enable SecAdmin1 to "manage passwords and invalidate sessions on behalf of non-administrative users" while honoring least privilege, assign Helpdesk administrator.