1. Users can register applications → No

2. Restrict access to Microsoft Entra ID administration portal → Yes

In Microsoft Entra ID (formerly Azure Active Directory), the Default User Role Permissions setting determines what standard (non-admin) users can do in the directory by default. To meet the two stated requirements —

Prevent standard users from creating new service principals (applications), and

Restrict them to managing only their own Azure resources using PowerShell or Microsoft Graph —

you must modify the following two settings:

1. Users can register applications → No

When this setting is enabled, any user in the directory can register applications, which automatically creates service principals in Microsoft Entra ID. These service principals can be used to grant access to resources, effectively creating new security identities.

According to the official Microsoft Entra Administrator documentation:

“If you want to prevent non-administrators from creating app registrations or service principals in your organization, disable the ‘Users can register applications’ setting under Default User Role Permissions.”

By setting Users can register applications = No, you prevent standard users from creating new app registrations or service principals, fulfilling the first requirement.

2. Restrict access to Microsoft Entra ID administration portal → Yes

This setting determines whether standard users can access the Microsoft Entra admin center (portal.azure.com). When you enable Restrict access to Microsoft Entra ID administration portal, standard users can no longer access or modify directory-wide settings through the portal.

However, they can still manage their own Azure resources via PowerShell or Microsoft Graph (within their permissions).

As documented in Microsoft Learn (Manage default user permissions in Microsoft Entra ID):

“To ensure that users can only manage their own objects and resources, but not the directory configuration, enable ‘Restrict access to Microsoft Entra ID administration portal.’ This restriction does not prevent the use of PowerShell or Graph API for personal resources.”

This meets the second requirement that standard users can only use automation tools to manage their own Azure resources.

Summary of Correct Settings:

Setting

Correct Value

Reason

Users can register applications

No

Prevents creation of service principals by standard users.

Restrict access to Microsoft Entra ID administration portal

Yes

Ensures users only manage their own resources using PowerShell or Graph.

✅ Final Verified Answer:

1. Users can register applications → No

2. Restrict access to Microsoft Entra ID administration portal → Yes

In Microsoft Entra ID (formerly Azure Active Directory), guest users (External Users) are typically added via B2B collaboration invitations. They authenticate using the identity provider (IdP) associated with the email they were invited with — such as a Microsoft account, Gmail (Google), or another organization’s Azure AD tenant.

When you need to change the authentication method or identity for a guest user — for example, from external195@gmail.com to contractor@gmail.com — you must modify their identities and ensure that their account status is enabled and synchronized with the new sign-in identity.

Step-by-step from Microsoft Documentation:

From Microsoft Learn – “Manage external collaboration settings in Microsoft Entra ID” and “Manage guest accounts in Azure AD”:

Identities

Under the Overview blade of the user, the Identities section lists all linked sign-in identities for that account.

You can remove the old identity (e.g., external195@gmail.com) and add the new one (contractor@gmail.com) as an alternate identity or replace the existing one.

This determines which external account the guest uses to authenticate to your tenant.

Account status

Once the new identity is added, ensure the Account status remains Enabled so that the user can sign in successfully.

If disabled, the user cannot authenticate even with the new email address.

This setting controls whether the guest user object is active in the directory.

Other fields such as User principal name, Object ID, or Reset password cannot directly modify the external identity since guest authentication relies on the federated identity provider of the external email domain.

Therefore, the administrator must use Identities to register or replace the authentication address, and Account status to ensure the user can log in using the new account.

The New-MgUser cmdlet is part of the Microsoft Graph PowerShell SDK, which is a module that allows you to interact with the Microsoft Graph API. The Microsoft Graph API is a service that provides access to data and insights across Microsoft 365, such as users, groups, mail, calendar, contacts, files, and more1.

The New-MgUser cmdlet can be used to create new users in your Azure AD tenant, but it has some limitations and requirements. For example, you need to have the Global Administrator or User Administrator role in your tenant, you need to authenticate with the Microsoft Graph API using a certificate or a client secret, and you need to specify the required parameters for the new user, such as userPrincipalName, accountEnabled, displayName, mailNickname, and passwordProfile2.

However, the New-MgUser cmdlet does not support creating guest user accounts in your Azure AD tenant. Guest user accounts are accounts that belong to external users from other organizations or domains. Guest user accounts have limited access and permissions in your tenant, and they are typically used for collaboration or sharing purposes3.

To create guest user accounts in your Azure AD tenant, you need to use a different cmdlet: New-AzureADMSInvitation. This cmdlet is part of the Azure AD PowerShell module, which is a module that allows you to manage your Azure AD resources and objects. The New-AzureADMSInvitation cmdlet can be used to create and send an invitation email to an external user, which contains a link to join your Azure AD tenant as a guest user. You can also specify some optional parameters for the invitation, such as the invited user display name, message info, redirect URL, or send invitation message.

Therefore, to meet the goal of creating guest user accounts for 500 external users from a CSV file, you need to use a PowerShell script that runs the New-AzureADMSInvitation cmdlet for each user, not the New-MgUser cmdlet.

The Logic App Operator role only grants the ability to read, enable, disable, and run logic apps. It does not grant the ability to create logic apps. To create logic apps, you need to assign the Logic App Contributor role or a higher-level role such as Owner or Contributor. Then, References: [Built-in roles for Azure resources] [Azure Logic Apps permissions and access control]

To ensure users can sign in to virtual machines that are assigned role1, modify the actions section.

To ensure that role1 can be assigned only to a resource group named RG1, modify the assignableScopes section.

In Azure Role-Based Access Control (RBAC), a custom role defines a collection of permissions that specify what actions a user or service principal can perform and the scope to which these permissions apply. The JSON definition of a custom role contains key properties including:

actions: Lists the management operations permitted (e.g., " Microsoft.Compute/virtualMachines/* " allows control over VMs).

notActions: Explicitly denies certain operations that would otherwise be allowed.

dataActions: Lists operations on data within a resource (e.g., blob reads/writes).

assignableScopes: Defines the scopes (subscriptions, resource groups, or resources) where the custom role can be assigned.

According to Microsoft Azure Administrator documentation, if you want to ensure that users assigned a role can sign in to virtual machines, you must include the appropriate sign-in permissions in the actions section. Specifically, you would add:

" Microsoft.Compute/virtualMachines/login/action "

This grants sign-in access to the VM via Azure RBAC.

Furthermore, if you want to restrict the scope of where the custom role can be assigned — for example, to a specific resource group like RG1 — you must define that restriction within the assignableScopes section. For example:

" assignableScopes " : [

" /subscriptions/{subscriptionId}/resourceGroups/RG1 "

]

This ensures that the custom role is only visible and assignable within that resource group, preventing assignments at subscription or management group levels.

These definitions align with official Microsoft RBAC schema guidelines described in Azure Role Definitions and Custom Roles Overview for Azure Resource Manager.

Azure Load Balancers are offered in two SKUs — Basic and Standard — each with distinct capabilities, scalability, and configuration requirements as documented in Microsoft Azure Administrator documentation.

LB1 – Basic Load Balancer (Basic SKU)The Basic Load Balancer is designed for small-scale, non-production workloads. It has certain limitations compared to the Standard SKU:

The backend pool of a Basic Load Balancer can only include virtual machines in a single availability set or a single virtual machine scale set.

This restriction ensures that the Basic Load Balancer maintains consistency and proper failover across VMs sharing the same availability set or scale set.

It cannot span multiple availability sets or virtual networks.

Therefore, to load balance VMs using a Basic Load Balancer, those VMs must be created in the same availability set or virtual machine scale set.

✅ Correct Option for LB1: be created in the same availability set or virtual machine scale set.

LB2 – Standard Load Balancer (Standard SKU)The Standard Load Balancer is designed for production-grade workloads and supports advanced features such as zone redundancy, secure by default configuration, and high scalability.

It supports backend pools composed of virtual machines from different availability zones (in the same region) and multiple virtual machine scale sets.

The only requirement is that all backend virtual machines must be connected to the same virtual network.

Standard Load Balancer also supports both public and internal load balancing and provides richer metrics and diagnostic capabilities.

Therefore, for LB2 (Standard), the virtual machines only need to reside within the same virtual network, regardless of their availability sets or zones.

✅ Correct Option for LB2: be connected to the same virtual network.

Microsoft Azure Official Extract (summarized):

“For Basic Load Balancer, backend pool VMs must belong to the same availability set or virtual machine scale set. For Standard Load Balancer, backend pool members can be across availability zones and scale sets, but must be connected to the same virtual network.”

(From Microsoft Azure Administrator Study Guide – Load Balancer Configuration and Comparison; Azure Docs: azure.microsoft.com > Load Balancer SKUs Comparison.)

Final Verified Answer:

✅ LB1: be created in the same availability set or virtual machine scale set

✅ LB2: be connected to the same virtual network

In Azure, load balancer configurations must have consistent SKU compatibility between the load balancer and its associated backend pool members. The Standard SKU Load Balancer requires that all backend pool members — such as virtual machines, network interfaces, or virtual machine scale sets — use Standard SKU public IPs or Standard SKU configurations if external, and proper network interface associations if internal.

However, in this question:

LB1 is an internal Standard SKU load balancer.

Internal load balancers do not require or support public IP addresses on the backend virtual machines.

Backend pool members of an internal load balancer are identified by private IP addresses from the virtual network, not public IPs.

According to Microsoft Azure Load Balancer documentation (Azure Administrator Guide, “Configure Standard Load Balancer”),

“For a Standard internal load balancer, the backend pool can contain only virtual machines or NICs that are in the same virtual network as the load balancer. Public IP addresses are not required and not supported for backend members.”

To correctly meet the goal, the proper solution is to:

Ensure that VM1 and VM2 are deployed within the same virtual network (VNET1) and subnet as LB1.

Ensure that the NICs of both VMs are configured with Standard SKU (if public IPs are attached elsewhere) to match the load balancer SKU.

Add these NICs or virtual machines directly to the backend pool of LB1.

Creating and assigning Standard SKU public IP addresses to each VM is unnecessary and does not help connect them to the internal load balancer. In fact, it contradicts Azure’s design for internal load balancers, which only route traffic using private addresses within the virtual network scope.

Therefore, the given solution does not meet the goal.