SC-200 Certification Practice Question #140

Question

You have an Azure subscription that contains a guest user named User1 and a Microsoft Sentinel workspace named workspace1.

You need to ensure that User1 can triage Microsoft Sentinel incidents in workspace1. The solution must use the principle of least privilege.

Which roles should you assign to User1? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

Accepted Answer

Triaging incidents requires the **Microsoft Sentinel Responder** role (Reader permissions plus "manage incidents"), and it is the least-privileged Sentinel role that can do so — Contributor adds unneeded create/edit rights. Because User1 is a guest user, MS Learn explicitly requires the **Directory readers** (Directory Reader) Microsoft Entra ID role, which regular non-guest users already have by default but guests do not. The MS Learn roles table states this combination verbatim ("Guest users assign incidents → Directory Reader AND Microsoft Sentinel Responder"). The community is unanimous (mali1969 12 👍, SJHCI 6 👍, Discuss4certi 3 👍) with no dissent, so confidence is high.

More SC-200 practice questions