SC-401 · Question #160
You have a Microsoft 365 E5 subscription that contains two users named User1 and User2. The subscription has a data loss prevention (DLP) policy named Policy1. User2 sends an outbound message that…
The correct answer is D. Global Reader. The Global Reader role provides read-only access across all Microsoft 365 admin centers and compliance portals, including the ability to view DLP alerts and download the matched message content that triggered them. Since the task only requires viewing/downloading the…
Question
You have a Microsoft 365 E5 subscription that contains two users named User1 and User2. The subscription has a data loss prevention (DLP) policy named Policy1. User2 sends an outbound message that generates a false positive for Policy1. You need to ensure that User1 can download the message that generated the alert. The solution must follow the principle of least privilege. To which role group should you add User1?
Options
- AData Investigator
- BSecurity Operator
- CeDiscovery Manager
- DGlobal Reader
How the community answered
(33 responses)- A3% (1)
- B6% (2)
- C12% (4)
- D79% (26)
Explanation
The Global Reader role provides read-only access across all Microsoft 365 admin centers and compliance portals, including the ability to view DLP alerts and download the matched message content that triggered them. Since the task only requires viewing/downloading the message-not taking administrative action-Global Reader is the least privileged role that satisfies the requirement. Data Investigator, eDiscovery Manager, and Security Operator all grant broader or action-based permissions beyond what is needed here.
Topics
Community Discussion
No community discussion yet for this question.