Cascade Regional Airlines' compliance officer discovers that an administrative unit scoped to the outstation offices was assigned the Helpdesk Administrator role to a regional technician, but the technician is still able to reset the password of a HQ pilot's account, which should be out of scope. What is the most likely explanation for this scope violation?

A role can be assigned to a user at more than one scope in Microsoft Entra ID, and each assignment is independent — a role assigned at the administrative-unit scope constrains that specific assignment to members of the unit, but it does not retract or override a separate assignment of the same (or a broader) role made at the tenant/directory scope. If the technician holds Helpdesk Administrator both at the administrative-unit scope and, separately, at the directory scope, the directory-scoped grant lets them act on any user in the tenant, including the HQ pilot, regardless of what the AU-scoped assignment intended. That's the real mechanism behind the violation: an audit needs to check for a redundant broader assignment, not assume the AU feature is broken. The claim that administrative units can't scope any role is factually wrong — many roles including Helpdesk Administrator and User Administrator explicitly support AU scoping, which is the entire point of the feature. The pilot being silently added into the outstation AU is possible in theory but far less likely than a duplicate role grant, and doesn't match the phrasing of the scenario, which describes normal AU-scoped access continuing to reach an out-of-scope user. Claiming password reset can never be scoped contradicts documented behavior and would make the whole feature pointless. An operational check is reviewing the technician's role assignments across all scopes in the Entra admin center and removing the unintended directory-scope grant.