MS-102 · Question #152
MS-102 Question #152: Real Exam Question with Answer & Explanation
The correct answer is C: Security Administrator. Security Administrator (C) is the least-privileged role in this answer set that grants access to Azure AD Identity Protection risk reports. While Security Reader would be even more restrictive and is generally preferred for read-only access, it is not available as a choice here.
Question
You have a Microsoft 365 subscription that contains an Azure AD tenant named contoso.com. The tenant includes a user named User1. You enable Azure AD Identity Protection. You need to ensure that User1 can review the list in Azure AD Identity Protection of users flagged for risk. The solution must use the principle of least privilege. To which role should you add User1?
Options
- AGlobal Administrator
- BService Administrator
- CSecurity Administrator
- DReports Reader
Explanation
Security Administrator (C) is the least-privileged role in this answer set that grants access to Azure AD Identity Protection risk reports. While Security Reader would be even more restrictive and is generally preferred for read-only access, it is not available as a choice here. Security Administrator provides full access to Identity Protection including viewing and managing risk policies and risk reports. Global Administrator (A) also has access but grants unrestricted access to all Azure AD features, clearly violating least privilege. Service Administrator (B) manages service health and support tickets and has no access to Identity Protection data. Reports Reader (D) provides access to Microsoft 365 usage and audit reports but does not include Identity Protection risk report data.
Topics
Community Discussion
No community discussion yet for this question.