To which group should you add the administrator?

You have an Azure Active Directory Domain Services (Azure AD DS) domain named contoso.com.

You need to provide an administrator with the ability to manage Group Policy Objects (GPOs). The solution must use the principle of least privilege.

To which group should you add the administrator?
A . AAD DC Administrators
B . Domain Admins
C . Schema Admins
D . Enterprise Admins
E . Group Policy Creator Owners

Answer: B

Explanation:

Only the Domain Admins group and the Enterprise Admins group can fully manage GPOs. Members of the Group Policy Creator Owners group can create new GPOs but they can’t link the GPOs to sites, the domain or OUs and they cannot manage existing GPOs.