You are looking to improve your organizations security posture after hearing about breaches and hacks of other organizations on the news. You have been looking into Azure Identity Protection and you…

Question

Options

• ASecurity Operator
• BGlobal Administrator
• CSecurity Administrator
• DHelpDesk Administrator

• A
  7% (3)
• B
  12% (5)
• C
  78% (32)
• D
  2% (1)

Explanation

Security Administrator (Option C) is the appropriate role because it grants full read and write access to Azure Identity Protection features - including configuring policies, reviewing risky users/sign-ins, and managing alerts - without including password reset capabilities, perfectly aligning with the principle of least privilege.

Why the other options are wrong:

• Security Operator (A) has limited permissions in Identity Protection, primarily read-only access, and cannot fully manage or configure the service.
• Global Administrator (B) does have full access to Identity Protection (and can reset passwords), but granting this role violates least privilege since it provides far more permissions than needed across the entire Azure tenant.
• HelpDesk Administrator (D) is focused on password resets and basic user support tasks - it does not provide the necessary access to Identity Protection features.

Memory Tip: Think of it this way - "Security Admin secures, HelpDesk resets." Whenever a question asks about full security feature management without password reset rights, Security Administrator is your go-to. If password resets are required alongside security tasks, that's a clue to consider a higher-privileged role - but only if least privilege isn't a concern.

No community discussion yet for this question.