SC-200 Certification Practice Question #166

Question

You have a Microsoft 365 subscription that uses Microsoft Defender for Endpoint and contains a user named User1 and a Microsoft 365 group named Group1. All users are assigned a Defender for Endpoint Plan 1 license.

You enable Microsoft Defender XDR Unified role-based access control (RBAC) for Endpoints & Vulnerability Management.

You need to ensure that User1 can configure alerts that will send email notifications to Group1. The solution must follow the principle of least privilege.

Which permissions should you assign to User1?

Accepted Answer

Multiple MS Learn pages (Configure alert notifications, incident/response-action notifications) state the exact requirement: the **Manage security settings** permission is what lets a user create email-notification rules. The B dissenters confuse the "Alerts (manage)" permission — which governs triaging and managing the alerts themselves — with the separate settings-level capability to configure who receives notifications; configuring notification rules lives under settings, not under alert handling. Suggested Answer, the dominant Most Voted (17), and the docs all converge on D, so D wins. Confidence is held at 85 rather than higher because the B camp is well-organized (a 4-👍 comment plus two others) and the question's specific framing of Unified RBAC permission names (where Microsoft maps this to "Authorization and settings \ Security settings \ Core security settings (manage)") differs cosmetically from the answer label "Manage security settings," leaving a small interpretation gap.

More SC-200 practice questions