NORTHSTAR SERVICES / IAM-451TENANT ADMINISTRATION INVESTIGATION
Regional admin boundary
Northstar's Tidewater support desk needs to manage regional accounts, but a pilot administrator can unexpectedly manage a remote employee.
STEP 1 OF 4
PRACTICE / MODULE 019 / MICROSOFT ENTRA
The role is assigned.
Who can it actually manage?
Work through regional delegation, tenant-wide user/group/device permissions and safe provisioning with two Northstar cases plus a five-checkpoint configuration clinic.
03 / APPLY THE DECISIONS
Prove the scope before making the change.
Two Northstar incidents investigate a regional administrator with excessive permissions and a contractor onboarding wave with attribute, branding and bulk-import challenges.
Tenant Configuration & Permissions Clinic
Change a fictional tenant baseline, observe effective rights, then investigate five incidents that require positive and negative validation.
Browser-only simulation · No Microsoft tenant connection · No saved configurationCONFIGURATION SANDBOX
What can each person actually do?
EFFECTIVE OPERATIONS / CURRENT BASELINEPermitted Denied Permitted Permitted Permitted Denied
Morgan registers an appDefault member permission OR Application Developer role
Morgan creates a new security groupOrdinary member; no creator-role exception assumed
Taylor resets a Tidewater user's passwordDirect AU membership OR additional tenant-wide role
Taylor resets a West Coast user's passwordOutside the AU: only the separate tenant-wide grant here
Taylor manages the Tidewater Staff group objectAU-scoped group object; does not scope its user members
Chris joins a supported Windows laptopAll users OR selected device-join pilot membership
Simplified policy model for the named Northstar identities. Real authorization depends on supported role actions, object scope, user/device state, licensing, client flow and current policy. Group creation, group ownership, user reset and device join are intentionally separate.
FIVE EVIDENCE-LED INVESTIGATIONS
Prove the right boundary
Correct decisions unlock the next investigation. Use the sandbox above to see how overlapping grants can change an expected outcome.
0 of 5 validatedIAM-851 / 01 / DEFAULT PERMISSIONS
Northstar blocks member application registration, yet Morgan registers a new app. Which evidence should the technician check first?
Available evidence
- Members may register applications is set to No.
- Morgan has an active Application Developer role.
- The app was created under Morgan's identity.
LEARN → PRACTICE → LAB → TROUBLESHOOT
Review the Learn guide →Limit the role. Verify the data. Protect the tenant.
Return to the guide to review scoped delegation and secure identity operations, or explore the SC-300 objective map.