MS-102 · Question #139
You have a Microsoft 365 subscription that contains an Azure AD tenant named contoso.com. The tenant includes a user named User1. You enable Azure AD Identity Protection. You need to ensure that…
The correct answer is B. Security Reader. Security Reader (B) is the least-privileged built-in Azure AD role that grants read-only access to Azure AD Identity Protection, including the list of users flagged for risk, risky sign-ins, and risk detection details. This satisfies the principle of least privilege because it…
Question
You have a Microsoft 365 subscription that contains an Azure AD tenant named contoso.com. The tenant includes a user named User1. You enable Azure AD Identity Protection. You need to ensure that User1 can review the list in Azure AD Identity Protection of users flagged for risk. The solution must use the principle of least privilege. To which role should you add User1?
Options
- ACompliance Administrator
- BSecurity Reader
- CReports Reader
- DUser Administrator
How the community answered
(39 responses)- A10% (4)
- B79% (31)
- C8% (3)
- D3% (1)
Explanation
Security Reader (B) is the least-privileged built-in Azure AD role that grants read-only access to Azure AD Identity Protection, including the list of users flagged for risk, risky sign-ins, and risk detection details. This satisfies the principle of least privilege because it provides only viewing rights without any ability to configure or manage Identity Protection policies. Security Administrator would also work but has broader permissions (manage, not just read), making it more privilege than necessary. Reports Reader provides access to usage and audit reports in Microsoft 365, but not specifically to Identity Protection risk data. Compliance Administrator and User Administrator do not grant access to Identity Protection risk reports.
Topics
Community Discussion
No community discussion yet for this question.