While preparing for the AZ-104 Microsoft Azure Administrator exam, many candidates struggle with understanding Azure AD tenant boundaries and delegated administration. In the enterprise world, this decision often hinges on ensuring proper governance boundaries between multiple Azure AD tenants while enabling delegated user creation. Let’s drill into a simulated tenant administration scenario.
The Scenario #
Tailspin Toys is a multinational company that manages multiple Azure Active Directory (Azure AD) tenants to serve different global subsidiaries and partner firms. The primary tenant, tailspin.onmicrosoft.com, contains all corporate user identities for Tailspin Toys employees. Recently, a new subsidiary launched an isolated Azure AD tenant named external.tailspin.onmicrosoft.com to manage identities unique to that business unit.
The corporate IT admin User1 from tailspin.onmicrosoft.com has initiated the creation of this new tenant, aiming to delegate user management for external.tailspin.onmicrosoft.com to select personnel. They want to ensure that the correct users have the ability to create and manage user accounts in the new, separate Azure AD tenant to comply with Tailspin’s enterprise governance and security policies.
Key Requirements #
To meet governance and operational policies, Tailspin Toys needs to assign permission to the appropriate user(s) so that new user accounts can be created in the external.tailspin.onmicrosoft.com tenant. This delegation must respect security boundaries typical in enterprise hybrid environments.
The Options #
- A) Delegate User4 from tailspin.onmicrosoft.com with user creation rights in external.tailspin.onmicrosoft.com
- B) Delegate User1 from tailspin.onmicrosoft.com with user creation rights in external.tailspin.onmicrosoft.com
- C) Delegate User2 from tailspin.onmicrosoft.com with user creation rights in external.tailspin.onmicrosoft.com
- D) Delegate User3 from tailspin.onmicrosoft.com with user creation rights in external.tailspin.onmicrosoft.com
Correct Answer #
B) Delegate User1 from tailspin.onmicrosoft.com with user creation rights in external.tailspin.onmicrosoft.com
The Architect’s Analysis #
Correct Answer #
Option B
Step-by-Step Winning Logic #
This solution aligns with Azure’s identity and access management best practices as outlined in Microsoft’s Cloud Adoption Framework (CAF) governance disciplines:
- Security Boundary Management: Azure AD tenants are isolated security boundaries. Users in one tenant do not have implicit administrative rights in another tenant.
- Delegated Administration: Only users explicitly provisioned or invited into a tenant with appropriate admin roles can create new users in that tenant.
- Operational Excellence: Ensures clear separation of duties and tenancy boundaries, minimizing risk and complexity.
- Hybrid Cloud Context: For enterprises managing multiple tenants or hybrid identities, correct delegation avoids accidental privilege escalation across tenants.
The Trap (Distractor Analysis) #
- Why not Option A (User4)? User4 exists in the original tenant and lacks administrative roles in the new tenant unless explicitly added, so cannot create users in the new tenant.
- Why not Options C or D? Same reasoning as A; these users aren’t provisioned with roles in the new tenant, so delegation fails governance requirements.
The Architect Blueprint #
Diagram depicting tenant boundary and delegated user creation flow:
Diagram Note: User1, as tenant creator, has delegated administrative rights in the new tenant, enabling user account creation. Other original tenant users do not have those rights by default.
The Decision Matrix (Mandatory for Associate Level) #
| Option | Est. Complexity | Est. Monthly Cost | Pros | Cons |
|---|---|---|---|---|
| A | Low | $0 | Simple delegation concept | Fails because no admin role in new tenant |
| B | Low | $0 | Correct tenant admin delegation; meets governance | Requires explicit tenant admin role |
| C | Low | $0 | Candidate delegation | Not valid without tenant roles |
| D | Low | $0 | Candidate delegation | Not valid without tenant roles |
Note: User delegation roles in Azure AD do not incur direct costs but improper assignments risk security breaches.
Real-World Practitioner Insight #
Exam Rule #
For the exam, always pick the user who has administrative access to the Azure AD tenant in question when dealing with cross-tenant user management scenarios.
Real World #
In enterprise hybrid cloud deployments involving Azure AD and Azure Arc, managing identity administration across multiple interconnected tenants requires clear governance controls. Typically, tenant creators or designated administrators are provisioned in each tenant to avoid privilege sprawl and to maintain compliance with organizational policy and data residency laws.