Least-privilege role for licensing, user-creation and group tasks
This sheet compares Correct pick, Wrong pick to avoid.
| Criterion | Correct pick | Wrong pick to avoid |
|---|---|---|
| Assign licences to a group in the Microsoft 365 admin center, on your own, no extra role needed | Groups Administrator, License Administrator, or User Administrator (any one alone) | Exchange Administrator or Global Reader (neither is sufficient) |
The verdict, the full comparison, 3 rules and 3 traps are part of AB-650 access. Unlock AB-650.