Compare Entra Role Permissions in Microsoft 365 Admin Center

SC-300 By islever Editorial Last updated

Create, configure, and manage Microsoft Entra identities

Short answer

B Use the Microsoft 365 admin center’s Compare roles view to compare the role permissions of the users’ assigned roles side by side with minimal administrative effort.

Question

You have an Azure AD tenant that contains the users shown in the following table.
Exhibit: Compare Entra Role Permissions in Microsoft 365 Admin Center
You need to compare the role permissions of each user. The solution must minimize administrative effort.
What should you use?
  1. the Microsoft 365 Defender portal
  2. the Microsoft 365 admin center Correct Answer
  3. the Microsoft Entra admin center
  4. the Microsoft Purview compliance portal

Key Takeaways

This item tests whether you recognize the Microsoft 365 admin center’s side-by-side Compare roles feature as distinct from the Entra admin center’s role-assignment management.

To compare role permissions for users in an Azure AD tenant with minimal administrative effort, use the Compare roles view in the Microsoft 365 admin center (B), not manual role inspection in the Microsoft Entra admin center.

Common mistake: The common wrong choice is Microsoft Entra admin center (C) because it is the identity portal; it shows assignments but lacks the purpose-built side-by-side role-permission comparison that satisfies the minimum-effort requirement.

Expert Analysis

The decisive verb is “compare.” The question does not ask where to assign roles, reset passwords, or investigate incidents; it asks for the quickest way to compare the permissions attached to different users’ roles. That word selection eliminates portals whose primary strength is service administration, security incidents, or compliance. Option A, Microsoft 365 Defender, is for threat protection; option D, Microsoft Purview, is for compliance and data governance. Neither provides a role-permission comparison view.

Why option C is a trap. Microsoft Entra admin center is the authoritative place to see users and their directory role assignments, and several comments defend it on that basis. But seeing a user’s assigned roles is not the same as comparing the permissions of those roles. An administrator would have to open each role or user separately and manually reconcile the permission lists, which fails the “minimize administrative effort” constraint. The Entra portal is still relevant for identity administration; it is just not the purpose-built comparison tool being tested.

Option B supplies the built-in comparison. The Microsoft 365 admin center includes a Compare roles feature on its role-assignment page. It presents role permissions side by side for up to three roles at a time, so the table’s users can be evaluated without manual page-by-page inspection. A comment explicitly points to the Microsoft Learn guidance stating that you can compare permissions for up to three roles at a time to find the least permissive role. That aligns exactly with the wording of the question, and B is the correct answer.

Exam takeaway. Match the requested task to the portal feature. Use Entra admin center for identity configuration and role assignment; use the Microsoft 365 admin center when the stem asks for a role-permission comparison with minimum effort.

Official Reference

These links open the official vendor documentation in a new tab.

Exam Strategy

When an SC-300 question says compare role permissions and minimize effort, map the verb to a portal feature. The Microsoft 365 admin center has a Compare roles view for up to three roles; the Entra admin center is best for assigning and reviewing roles per user, not side-by-side entitlement comparison. Scan options for the portal that exposes a built-in comparison, not the portal you would use to create the users or assign the roles.

Frequently Asked Questions

Does the Microsoft Entra admin center provide the Compare roles feature needed here?

The Entra admin center is used to assign and review directory roles, but this scenario expects the Microsoft 365 admin center's Compare roles view for side-by-side permission comparison.

How many roles can Compare roles compare at a time?

Up to three roles at a time, which lets the table's users be evaluated without opening each role individually.

Why not use the Microsoft Purview compliance portal?

Purview focuses on compliance, data governance, and risk; it does not provide role-permission comparison for Entra directory roles.

More SC-300 FAQ →

Discussion 48 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 30 of 48

  1. Julesy 👍 15 Answered B
    https://learn.microsoft.com/en-us/microsoft-365/admin/add-users/admin-roles-page#compare-roles
  2. vladi72 👍 8 Answered C
    The answer is C. https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/permissions-reference Microsoft 365 admin center doesn't have Application Administrator role
  3. Alscoran 👍 5
    When you look at that site and the available roles, you WILL NOT see the Application Administrator listed. You do see all three when you look at Entra roles. So it must be C.
  4. jtlucas99 👍 4
    If you dont include the answer choices: You should use the Azure Active Directory (Azure AD) Privileged Identity Management (PIM). Azure AD PIM provides a consolidated view of the role assignments across your organization, and it makes it easy to see who has what permissions. If you include the answer options given: B. the Microsoft 365 admin center. The Microsoft 365 admin center provides a consolidated view of the role assignments across your organization, and it makes it easy to see who has what permissions. This solution minimizes administrative effort as it provides a centralized view and management of role assignments. Please note that the other options: A. the Microsoft 365 Defender portal is primarily used for managing security threats. C. the Microsoft Entra admin center does not exist. D. the Microsoft Purview compliance portal is used for data governance and compliance, not for managing user roles and permissions.
  5. PD1 👍 4 Answered C
    To compare the role permissions of each user in your Azure AD tenant with minimal administrative effort, you should use the Microsoft Entra admin center (Option C). The Microsoft Entra admin center is specifically designed to manage and monitor your Microsoft Entra ID (formerly known as Azure Active Directory). It allows you to view and manage user roles and permissions efficiently.
Show 25 more comments
  1. JuanZ 👍 4 Answered B
    https://learn.microsoft.com/en-us/microsoft-365/admin/add-users/assign-admin-roles?view=o365-worldwide#compare-roles You can now compare permissions for up to 3 roles at a time so you can find the least permissive role to assign. In the admin center
  2. Er_01 👍 4 Answered B
    So it is B because it actually has a “compare roles” button to compare up to 3 roles with. So the question is not about actually comparing roles, but where the menu option is to do it the MS way. More certification trivia!
  3. MacDanorld 👍 4 Answered B
    The Answer is B. the Microsoft 365 admin center. I have tested it and all roles are there and you can compare them in the 365 admin center
  4. Grg433 👍 3 Answered C
    Option B: the Microsoft 365 admin center is primarily used for managing Microsoft 365 services, such as users, groups, licenses, and basic security settings. However, it does not provide detailed insights into Azure AD role permissions or allow for a direct comparison of role permissions assigned to users. To specifically compare and manage Azure AD roles and permissions, Microsoft Entra admin center (Option C) is the correct tool, as it focuses on identity and access management within Azure AD. Therefore, while Option B allows for some user and role management, it does not meet the requirement to compare detailed role permissions in Azure AD. Option C is more suitable for this task.
  5. NotanAdmin 👍 3
    The correct answer is B. the Microsoft 365 admin center. The Microsoft 365 admin center provides a centralized location where you can view and manage the role permissions of each user in your Azure AD tenant. This will allow you to easily compare the permissions of Admin1, Admin2, and Admin3, thus minimizing administrative effort. The other options do not provide this specific functionality.
  6. baz 👍 3
    B. Testing we can see all role in both admin centers but 0365 admin has the option to "compare" roles.
  7. penatuna 👍 3 Answered B
    Just tested with Microsoft 365 admin center, and you can compare all three roles mentioned.
  8. Softeng 👍 3 Answered B
    It's M365 admin portal. Look at Julesy link.
  9. AlexBrazil 👍 3
    It does have. I've checked.
  10. Neshiri 👍 2 Answered C
    The correct answer is: C. the Microsoft Entra admin center Here's why: To compare role permissions of users in an Azure AD tenant, you need to view and manage directory roles assigned to each user. The Microsoft Entra admin center (formerly Azure AD portal) is specifically designed for managing: User identities Role assignments Access control Conditional access policies Why not the others? A. Microsoft 365 Defender portal: Focuses on security operations, threat protection, and incident response—not role management. B. Microsoft 365 admin center: Useful for basic user and license management, but limited in detailed role comparison across Azure AD. D. Microsoft Purview compliance portal: Used for compliance, data governance, and auditing—not for managing or comparing user roles.
  11. osi22 👍 2 Answered C
    Looking at the current state (03.01.24) we have the roles available in both B and C! MS 365 Admin center - Application Administrator: Create and manage enterprise application, registrations, and proxy settings, excluding Microsoft Graph and Azure AD Graph Consent to delegated permissions and application permissions MS Entra Admin Center - Application Adminstrator: Users in this role can add, manage, and configure enterprise applications, app registrations and manage on-premises like app proxy. There's also no difference in the remaining roles, however thinking in the MS world, I still would go for C!
  12. AcTiVeGrEnAdE 👍 2 Answered B
    I am really surprised that the Entra Id Admin Center would not have this capability but the answer is surprisingly the M365 Admin Portal.
  13. Oskarma 👍 2 Answered B
    Just tested in my tenant. You can choose the THREE roles to compare them. :-)
  14. cpaljchc4 👍 2 Answered B
    I think there's a similar question in MS-102 and answer is M365 admin
  15. Blagojche 👍 2
    Application Administrator is present in M365 Admin Center, check!
  16. Florian74 👍 2 Answered B
    To compare roles: M365 admin portal
  17. Edinelk 👍 2 Answered C
    It looks C
  18. haazybanj 👍 2 Answered B
    B is right
  19. 16e52c8 👍 1 Answered C
    The correct tool to compare the role permissions of each user is the Microsoft Entra admin center. The Microsoft Entra admin center (formerly Azure AD portal) is the dedicated portal for managing user identities, role assignments, and access control within Microsoft Entra ID. It allows administrators to view and manage directory roles assigned to each user efficiently. While the Microsoft 365 admin center also allows for some basic user and license management, it is limited in detailed, granular role comparison across Azure AD roles. o compare the roles: Navigate to the Microsoft Entra admin center. Go to Identity > Users > All users. Select a specific user, then view their Assigned roles to see all roles at various scopes. Repeat the process for other users to compare their permissions.
  20. 16e52c8 👍 1 Answered C
    The correct tool to compare the role permissions of each user is the Microsoft Entra admin center. This portal is specifically designed for managing user identities, role assignments, and access control within Microsoft Entra ID (formerly Azure AD), which minimizes administrative effort for this task
  21. Er_01 👍 1
    All 3 accounts are listed with role permissions in both portals. Since Entra is the place for ID management, the MS answer would be C. Also, the m365 portal lists the name of each permission not the actual syntax for each user right. Again, this supports the MS answer.
  22. Ed2learn 👍 1
    I don't see Application Administrator in the Microsoft 365 admin center. Unless I am missing it, the answer is C. I suspect they are trying to make the question about the tool so perhaps in the exam they use a different role than Application Admin?
  23. Alscoran 👍 1
    Weird that it doesn't show in the documentation but does show up in the admin center. I cannot find a compare function on the Entra ID portal either. So I guess its B after all !
  24. Blabla532 👍 1 Answered C
    Microsoft 365 admin center: While you can assign roles here, it does not offer a dedicated side-by-side comparison tool for the specific permissions of multiple directory roles.
  25. user1234543210 👍 1 Answered B
    if you have done this before, you know its not C. M365 admin center will allow you to select compare roles and give you a clear visual to compare

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

How Long Are Microsoft Entra Risky User Activity Logs Retained?

S-grade

Azure User-Assigned Managed Identity Regional Scope

S-grade

Which role for the Permissions Management service principal?

S-grade

Prerequisite for Microsoft Defender for Cloud Apps Session Policy

S-grade

Practice All SC-300 Questions

Access 80 questions with complete answers and detailed explanations.

View Full SC-300 Practice Test →

← Back to SC-300 Study Guide