3.1. Configure and Manage a Microsoft Entra Tenant

💡 First Principle: Tenant administration is authorization applied to the directory itself — the triad from 1.3.2 (principal, role, scope) pointed inward. Roles define what directory power exists, administrative units define where it applies, and tenant settings define the defaults every identity inherits.

Why care: over-privileged admin accounts are the highest-value target in any tenant, and Microsoft's guidance is blunt — minimize Global Administrators (fewer than five), scope everything else down, and audit what remains. The exam operationalizes this relentlessly: nearly every "which role should you assign?" question is really "which is the least privileged role that can do this?"

⚠️ Common Misconception: Day-to-day tasks need Global Administrator. Nearly every task has a narrower built-in role — User Administrator, Authentication Administrator, Application Administrator, Groups Administrator — and answers choosing Global Admin are almost always wrong unless the task is genuinely tenant-wide (and even then, PIM-protected).