Assigning Least Privilege for Entra Permissions Management License Purchase

SC-300 By islever Editorial Last updated

Short answer

B Assign the Billing Administrator role to User1 to enable license purchasing capabilities while maintaining least privilege.

Question

You have an Azure subscription named Sub1 that contains a user named User1. You need to ensure that User1 can purchase a Microsoft Entra Permissions Management license for Sub1. The solution must follow the principle of least privilege. Which role should you assign to User1?
  1. Global Administrator
  2. Billing Administrator Correct Answer
  3. Permissions Management Administrator
  4. User Access Administrator

Key Takeaways

Tests the distinction between administrative management roles and billing/transactional roles in Microsoft Entra ID, specifically highlighting that license purchases require financial permissions.

Determines the specific Azure AD role required to purchase Microsoft Entra Permissions Management licenses while adhering to least privilege principles. Establishes that Billing Administrator is the correct role for transactional access.

Common mistake: Candidates often select Global Administrator (A) assuming it has all permissions, or Permissions Management Administrator (C) assuming it covers licensing. This ignores the explicit requirement for purchasing capabilities which are tied to billing functions.

Expert Analysis

Why the Answer Is Correct

The question requires a solution that follows the principle of least privilege while allowing User1 to purchase a license. In Microsoft Entra ID (Azure AD), the act of purchasing a subscription or license is a financial transaction managed by the Billing Administrator role. According to official Microsoft documentation, the Billing Administrator role includes permissions to make purchases, manage subscriptions, and monitor service health. Therefore, assigning this role provides the necessary capability without granting broader administrative privileges like those held by a Global Administrator.

Why the Other Options Are Wrong

Global Administrator (A) grants full access to all administrative features in Microsoft Entra ID but violates the principle of least privilege as it is far more powerful than needed for a simple purchase. Permissions Management Administrator (C) allows managing the settings and policies within the Permissions Management product itself but does not inherently grant permission to purchase the license from the store or billing portal; one must be able to buy it before configuring it. User Access Administrator (D) manages role assignments but does not have permissions to perform financial transactions or purchase services.

Community Comment Notes

Community consensus heavily favors Billing Administrator (B), with multiple users citing official Microsoft docs confirming that "To activate a trial or purchase a license..." requires specific billing permissions. One user correctly noted that "Billing Administrator can: Makes purchases, manages subscriptions..." Another user pointed out that Global Admins can do it, but emphasized that the question asks for least privilege, making Billing Admin the superior choice. A minority suggested Global Admin, arguing that only they can purchase, but this contradicts the documented capabilities of the Billing Administrator role regarding subscription management.

Official Reference

https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/permissions-reference#billing-administrator

This link opens the official vendor documentation in a new tab.

Exam Strategy

Always look for keywords like 'purchase', 'subscribe', or 'billing' when selecting roles. If the task involves money or subscription activation, think Billing Administrator first, then evaluate if higher privileges are strictly necessary. Remember that 'Least Privilege' is a key constraint in SC-300 questions.

Frequently Asked Questions

Why isn't Permissions Management Administrator sufficient?

This role manages the tool's configuration but does not grant permission to purchase the license from the Microsoft Store or billing portal.

Can a Global Administrator purchase the license?

Yes, but it violates the principle of least privilege. The exam requires the minimal role necessary, which is Billing Administrator.

More SC-300 FAQ →

Community Votes

B
100%

100% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 13 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 13

  1. penatuna 👍 3 Answered A
    I would say A. Global Administrator. "To activate a trial or purchase a license, you must have Global Administrator permissions." https://learn.microsoft.com/en-us/entra/permissions-management/product-roles-permissions#enabling-permissions-management "There are two ways to activate a trial or a full product license. The first way is to go to the Microsoft 365 admin center. • Sign in as a Global Administrator for your tenant. • Go to Setup and sign up for a Microsoft Entra Permissions Management trial. • For self-service, Go to the Microsoft 365 portal to sign up for a 45-day free trial or to purchase licenses. The second way is through Volume Licensing or Enterprise agreements. • If your organization falls under a volume license or enterprise agreement scenario, contact your Microsoft representative." https://learn.microsoft.com/en-us/entra/permissions-management/onboard-enable-tenant#activate-a-free-trial-or-paid-license
  2. BMO3 👍 3
    User1 need to be able to purchase the license. Only Global admins can purchase an Entra Permissions Management license, as stated in MS docs: https://learn.microsoft.com/en-us/entra/permissions-management/product-roles-permissions
  3. mohamedbenamor 👍 3 Answered B
    https://learn.microsoft.com/en-us/entra/permissions-management/product-roles-permissions#enabling-permissions-management
  4. throwaway10188 👍 2
    To complete this task, you must have at least Billing Administrator permissions. You can't enable Permissions Management as a user from another tenant who has signed in via B2B or via Azure Lighthouse. Prerequisites To enable Permissions Management in your organization: You must be eligible for or have an active assignment to the Permissions Management Administrator role as a user in that tenant. Therefore, I think that Permissions Management Administrator might be the best role. C. https://learn.microsoft.com/en-us/entra/permissions-management/onboard-enable-tenant
  5. jim85 👍 2 Answered B
    https://learn.microsoft.com/en-us/entra/permissions-management/product-roles-permissions - Billing Admin
Show 8 more comments
  1. YesPlease 👍 1 Answered B
    Answer B) Billing Administrator Billing Administrator can: Makes purchases, manages subscriptions, manages support tickets, and monitors service health. https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/permissions-reference#billing-administrator
  2. Menard001 👍 1 Answered B
    The solution must follow the principle of least privilege. is the global admin is least privilege account? I think that is billing admin
  3. criminal1979 👍 1 Answered B
    https://learn.microsoft.com/en-us/entra/permissions-management/onboard-enable-tenant
  4. csi_2025 👍 1 Answered B
    What is sub1? A user? A submarine? A substitute?
  5. ignitelatam 👍 11 Answered B
    Correct
  6. ELQUMS 👍 3
    Billing administrator
  7. seleneliane 👍 1
    It's A that i will choose!
  8. PD1 👍 1 Answered B
    B. Billing Administrator

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

How Long Are Microsoft Entra Risky User Activity Logs Retained?

S-grade

Azure User-Assigned Managed Identity Regional Scope

S-grade

Which role for the Permissions Management service principal?

S-grade

Prerequisite for Microsoft Defender for Cloud Apps Session Policy

S-grade

Practice All SC-300 Questions

Access 80 questions with complete answers and detailed explanations.

View Full SC-300 Practice Test →

← Back to SC-300 Study Guide