SC-200 · Question #314
You have a Microsoft 365 subscription that uses Microsoft Defender for Endpoint and contains a user named User1 and a Microsoft 365 group named Group1. All users are assigned a Defender for Endpoint…
The correct answer is D. Manage security settings. To allow User1 to configure email notifications for alerts in Microsoft Defender XDR with least privilege, they must be assigned the 'Manage security settings' permission.
Question
You have a Microsoft 365 subscription that uses Microsoft Defender for Endpoint and contains a user named User1 and a Microsoft 365 group named Group1. All users are assigned a Defender for Endpoint Plan 1 license. You enable Microsoft Defender XDR Unified role-based access control (RBAC) for Endpoints & Vulnerability Management. You need to ensure that User1 can configure alerts that will send email notifications to Group1. The solution must follow the principle of least privilege. Which permissions should you assign to User1?
Options
- ADefender Vulnerability Management - Remediation handling
- BAlerts investigation
- CLive response capabilities: Basic
- DManage security settings
How the community answered
(50 responses)- A4% (2)
- B14% (7)
- C8% (4)
- D74% (37)
Why each option
To allow User1 to configure email notifications for alerts in Microsoft Defender XDR with least privilege, they must be assigned the 'Manage security settings' permission.
'Live response capabilities: Basic' allows users to perform basic live response actions on devices, which is unrelated to configuring email notifications for security alerts.
The 'Manage security settings' permission in Microsoft Defender XDR allows a user to configure global security settings, including creating and managing alert rules, configuring notification settings (like email notifications), and managing custom rules. This role directly addresses the requirement for User1 to configure alerts that send email notifications.
Concept tested: Microsoft Defender XDR RBAC for alert configuration
Source: https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/rbac-roles-permissions?view=o365-worldwide
Community Discussion
No community discussion yet for this question.