SC-200 Certification Practice Question #83

Question

You have an Azure subscription that uses Microsoft Defender for Cloud and contains a user named User1.

You need to ensure that User1 can modify Microsoft Defender for Cloud security policies. The solution must use the principle of least privilege.

Which role should you assign to User1?

Accepted Answer

Modifying Defender for Cloud security policies requires the "Edit security policy" permission, which MS Learn's permissions table grants to Security Admin and Owner only. Among the four choices, Security Admin is the least-privileged role that can edit policies — Security Reader/operator can only view, Contributor cannot edit security policy per the role table, and Owner is broader than needed. The Suggested answer and a unanimous Most Voted (14 votes, 6-👍 top comment) agree on B, and MS Learn states it directly. The lone dissent citing "Contributor" relies on a different (ESI) question and is contradicted by Microsoft's own role-and-allowed-actions table.

More SC-200 practice questions