SC-300 Certification Practice Question #270

Question

You have an Azure subscription that is linked to a Microsoft Entra tenant. The tenant contains the identities shown in the following table.

The tenant is onboarded to Permissions Management.

You create the Azure resources shown in the following table.

From Microsoft Entra Insights, which identity will be included in Accounts assigned to highly privileged roles, and which identity will be included in Service principals with privileged role assignments?

Accepted Answer

Microsoft Entra Insights in Permissions Management separates "Review Global Administrators" from "Review highly privileged roles / Review service principals." The fixed highly-privileged role set is Application Administrator, Cloud Application Administrator, Exchange Administrator, Intune Administrator, Privileged Role Administrator, SharePoint Administrator, Security Administrator, and User Administrator. Among the user/group identities, only Group2 (Exchange Administrator) falls in that set — Group1's Global Administrator role is surfaced separately, and Helpdesk/Conditional Access Administrator are not privileged-role-insights roles. Among the workload identities, only Managed2 (Cloud Application Administrator) is in the set; Authentication Administrator (App1) and Security Operator (SPrincipal1) are not listed, and Managed1's Owner role is an Azure RBAC resource role rather than an Entra directory role. The "tested!!!" top comment (5 👍) and rvln7 (3 👍) independently confirm Group2 / Managed2, so confidence sits at 88% rather than higher only because no official Suggested Answer letter is recorded in the file.

More SC-300 practice questions