SC-200 Certification Practice Question #171

Question

You have a Microsoft 365 E5 subscription that contains two groups named Group1 and Group2 and uses Microsoft Copilot for Security.

You need to configure Copilot for Security role assignments to meet the following requirements:

•	Ensure that members of Group1 can run prompts and respond to Microsoft Defender XDR security incidents.
•	Ensure that members of Group2 can run prompts.
•	Follow the principle of least privilege.

You remove Everyone from the Copilot Contributor role.

Which two actions should you perform next? Each correct answer presents part of the solution.

NOTE: Each correct selection is worth one point.

Accepted Answer

Group1 must run prompts AND respond to Defender XDR incidents. Per MS Learn, the Copilot role only grants platform/session access — accessing Defender XDR data requires a separate Defender role, and the **Security Operator** role provides incident-response privileges without full admin rights, satisfying least privilege (A). Group2 only needs to run prompts; since Everyone was removed from Copilot Contributor, Group2 must be granted **Copilot Contributor** to create sessions (E). Owner-based options (B, C) over-privilege, and Security Operator for Group2 (D) grants unneeded incident access. The note on confidence: the printed Suggested Answer field lists only "E," but the question requires two selections and the 9-vote Most Voted plus the top Highly Voted comment resolve the pair to A + E; one commenter observes Group1 technically also needs Contributor to prompt, but no such option exists, so A + E is the best available pair.

More SC-200 practice questions