Hotspot Question You have a Microsoft 365 E5 subscription that contains a user named User1. You configure app governance integration. User1 needs to view the App governance dashboard. The solution…

Question

Answer Area

• Role:Cloud Application Administrator
  Application AdministratorApplication DeveloperCloud Application Administrator
• Portal:The Microsoft 365 Defender portal
  The Microsoft 365 admin centerThe Microsoft 365 Defender portalThe Microsoft Defender for Cloud Apps portalThe Microsoft Purview compliance portal

Explanation

To view the App governance dashboard with least privilege, User1 should be assigned the Application Administrator role and access the Microsoft 365 Defender portal.

Approach. The question asks for the role with the least privilege for User1 to view the App governance dashboard and the portal to access it.

For the 'Role': App governance is a feature that monitors and governs app behavior in the Microsoft cloud ecosystem. It falls under the management of applications and security. The 'Application Administrator' role is specifically designed for managing enterprise applications, application registrations, and service principals. It grants permissions to view and manage many aspects of applications, making it suitable for viewing the App governance dashboard without granting overly broad permissions like a Global Administrator or Security Administrator. Among the given options, 'Application Administrator' provides the necessary viewing permissions while adhering to the principle of least privilege more closely than 'Cloud Application Administrator', which has slightly broader management capabilities (e.g., managing all aspects of enterprise applications).

For the 'Portal': App governance is an add-on capability of Microsoft Defender for Cloud Apps (MDCAS). Microsoft is consolidating its security experiences into a unified portal. The Microsoft 365 Defender portal (security.microsoft.com) is the central hub for all Microsoft XDR capabilities, including Microsoft Defender for Endpoint, Defender for Office 365, Defender for Identity, and Defender for Cloud Apps (which hosts App governance). Therefore, the App governance dashboard is viewed through the Microsoft 365 Defender portal.

Common mistakes.

• common_mistake. 1. Incorrect Role Choices:
  • Application Developer: This role is primarily for developing and managing applications owned by the user, not for administering or viewing enterprise-wide application governance dashboards.
  • Cloud Application Administrator: While this role has extensive application management permissions, 'Application Administrator' is a slightly less privileged role that is sufficient for viewing the dashboard. Given the 'least privilege' requirement, 'Application Administrator' is the more appropriate choice if it meets the viewing requirement.

1. Incorrect Portal Choices:
   • The Microsoft 365 admin center: This portal is for general Microsoft 365 service administration, user management, and billing, not for detailed security dashboards like App governance.
   • The Microsoft Defender for Cloud Apps portal: While App governance is a feature of MDCAS, Microsoft is actively consolidating security portals. The functionalities of the standalone MDCAS portal (portal.cloudappsecurity.com) are being migrated or integrated into the unified Microsoft 365 Defender portal. Selecting the standalone MDCAS portal might indicate outdated knowledge of Microsoft's portal consolidation strategy.
   • The Microsoft Purview compliance portal: This portal focuses on compliance, data governance, eDiscovery, and privacy management across Microsoft 365 services. It does not host App governance dashboards, which are security-focused.

Concept tested. This question tests the candidate's knowledge of Azure Active Directory (now Microsoft Entra ID) Role-Based Access Control (RBAC), specifically the appropriate administrative roles for managing and viewing application security features like App governance, and their understanding of the Microsoft 365 security ecosystem, including the correct portals for accessing specific security features (Microsoft 365 Defender portal) and the principle of least privilege.

Reference. https://learn.microsoft.com/en-us/microsoft-365/security/defender-cloud-apps/app-governance-get-started?view=o365-worldwide https://learn.microsoft.com/en-us/azure/active-directory/roles/permissions-reference#application-administrator

No community discussion yet for this question.