SC-200 Certification Practice Question #115

Question

You use Azure Sentinel.
You need to use a built-in role to provide a security analyst with the ability to edit the queries of custom Azure Sentinel workbooks. The solution must use the principle of least privilege.
Which role should you assign to the analyst?

Accepted Answer

Editing the queries of a custom Sentinel workbook requires the ability to create/edit Sentinel resources, which among the built-in roles offered is granted by Microsoft Sentinel Contributor (it includes all Responder permissions plus create/edit of workbooks and analytics rules). Microsoft Sentinel Responder can only view/manage incidents and data — it cannot edit workbooks. Security Administrator is a tenant-wide privileged role that far exceeds what is needed, breaking the least-privilege requirement, and Logic App Contributor only covers playbooks. The Suggested Answer, a unanimous Most Voted (A), and multiple highly-voted comments all agree with the MS Learn roles matrix, so confidence is high.

More SC-200 practice questions