Can the role "Authentication Administrator" configure passwordless authentication?

Question

With the task:

"You need to configure passwordless authentication. The solution must follow the principle of least privilege."

Which role should be assigned to complete the task?
I would say Authentication administrator, but the Microsoft practice assessment for AZ-500 claims that : "Configuring authentication methods requires Global Administrator privileges."
Is this correct?

Answer 1

Depends on the "target" user. Only certain roles can change authentication details on privileged/admin accounts. I.e. to change this for a user holding the User administrator role, you will need to be assigned at least the Privileged Authentication admin role. For the rest, you will be fine with Authentication administrator indeed.

You can refer to this article for the "least privileged" role for any given operation: https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/delegate-by-task