You have a Microsoft 365 E5 subscription. You create a user named Admin1. You need to ensure that Admin1 can view Endpoint security policies from the Microsoft Defender portal. The solution must…

The correct answer is B. Security Reader. The Security Reader role is the least privileged option that grants read-only access to security features, including the ability to view Endpoint security policies in the Microsoft Defender portal. Security Administrator (D) also has access but grants write permissions and is…

Submitted by klara.se· Apr 18, 2026Implement and manage Microsoft Entra identity and access

Question

You have a Microsoft 365 E5 subscription. You create a user named Admin1. You need to ensure that Admin1 can view Endpoint security policies from the Microsoft Defender portal. The solution must follow the principle of least privilege. Which Microsoft Entra role should you assign to Admin1?

Options

ACloud Device Administrator
BSecurity Reader
CGlobal Reader
DSecurity Administrator
ESecurity Operator

How the community answered

(24 responses)

B
88% (21)
C
8% (2)
E
4% (1)

Explanation

The Security Reader role is the least privileged option that grants read-only access to security features, including the ability to view Endpoint security policies in the Microsoft Defender portal. Security Administrator (D) also has access but grants write permissions and is over-privileged for a view-only requirement. Global Reader (C) provides broader read access across all Microsoft 365 services, which exceeds what is needed. Cloud Device Administrator (A) manages devices but does not specifically cover Defender portal security policy visibility. Security Operator (E) has some interactive response capabilities beyond just reading.

Topics

#Microsoft Entra roles#Least privilege#Security Reader#Endpoint security

Community Discussion

No community discussion yet for this question.

Full MS-102 Practice