Microsoft AB-650 Exam - Topic 2 Question 2 Discussion

Microsoft Entra ID provides role-based access control (RBAC) for administrative tasks, including the management of verified custom domain names.

Option D is correct because admin1@contoso.onmicrosoft.com holds the Domain Name Administrator role, which is the least-privileged Microsoft Entra built-in role capable of managing custom domains.

Microsoft explicitly documents that the Domain Name Administrator role includes permissions to add, verify, update, and delete custom domain names.

The scenario also satisfies the prerequisites for domain removal: contoso.com is not the default domain, and no users, groups, or applications reference it.

Furthermore, the administrator's user principal name uses contoso.onmicrosoft.com, rather than the domain being deleted. This avoids a dependency that would otherwise prevent removal.

Option A is incorrect because the License Administrator role manages licensing assignments and does not provide domain deletion permissions.

Option B is incorrect because the Global Administrator role can delete custom domains but grants significantly broader administrative privileges than necessary.

Option C is incorrect because the User Administrator role manages user and certain group-related operations but does not provide the required domain-management permissions.

Administrators can remove the domain through the Microsoft Entra admin center under Entra ID, Domain names, and Custom domain names.

Therefore, admin1@contoso.onmicrosoft.com is the correct account because it meets the requirement while following the principle of least privilege.