You have a Microsoft 365 E5 subscription that uses Microsoft Defender XDR and contains a user named User1. You need to ensure that User1 can manage Microsoft Defender XDR custom detection rules and…

The correct answer is B. Security Operator. The Security Operator role in Microsoft 365 Defender has permissions to manage custom detection rules and endpoint security policies, while being more restrictive than Security Administrator - satisfying the principle of least privilege. Security Administrator (A) grants…

Submitted by paula_co· Apr 18, 2026Manage a security operations environment

Question

You have a Microsoft 365 E5 subscription that uses Microsoft Defender XDR and contains a user named User1. You need to ensure that User1 can manage Microsoft Defender XDR custom detection rules and Endpoint security policies. The solution must follow the principle of least privilege. Which role should you assign to User1?

Options

ASecurity Administrator
BSecurity Operator
CCloud Device Administrator
DDesktop Analytics Administrator

How the community answered

(41 responses)

A
5% (2)
B
83% (34)
C
2% (1)
D
10% (4)

Explanation

The Security Operator role in Microsoft 365 Defender has permissions to manage custom detection rules and endpoint security policies, while being more restrictive than Security Administrator - satisfying the principle of least privilege. Security Administrator (A) grants broader permissions including the ability to manage all security policies and configurations across the tenant, which is more than required. Cloud Device Administrator (C) manages device join and registration settings, not detection rules. Desktop Analytics Administrator (D) is scoped to Desktop Analytics service only and cannot manage Defender XDR detection rules or endpoint security policies.

Topics

#RBAC#Microsoft Defender XDR#Least Privilege#Security Operator role

Community Discussion

No community discussion yet for this question.

Full SC-200 Practice