Microsoft Azure Administrator (AZ104) Practice Exam

If a Global Administrator creates a new Azure Active Directory tenant, who can create user accounts in that tenant?

1. Only Global Administrators of the parent tenant

2. Only the Owner of the Azure Subscription

3. Any User Administrator within the tenant

4. Global Administrators of the new tenant

The correct answer is: Global Administrators of the new tenant

When a new Azure Active Directory (Azure AD) tenant is created by a Global Administrator, that role is the highest level of permissions within the tenant. Global Administrators are granted comprehensive access and control over all aspects of the Azure AD environment. This includes the ability to create and manage users. Global Administrators hold the authority to create new user accounts, manage access to resources, and assign roles within the Azure AD tenant. Once the tenant is established, only the Global Administrators within that specific tenant can create user accounts, as the management capabilities of Global Administrators are restricted to their designated tenant. In contrast, roles such as User Administrators have the ability to manage user accounts and group memberships but cannot create new Global Administrators. The Owner of the Azure Subscription typically manages usage of resources and access to subscriptions but does not inherently have privileges over the Azure AD tenant's user account creation unless they hold the Global Administrator role. Thus, it is exclusively the Global Administrators of the new tenant who possess the capability to create user accounts in the same tenant they have administrative rights over.