Question
Your company deploys the following services:
- Microsoft Defender for Identity
- Microsoft Defender for Endpoint
- Microsoft Defender for Office 365
You need to provide a security analyst with the ability to use the Microsoft 365 security center. The analyst must be able to approve and reject pending actions generated by Microsoft Defender for Endpoint. The solution must use the principle of least privilege.
Which two roles should you assign to the analyst? Each correct answer presents part of the solution.
NOTE: Each correct selection is worth one point.
- A. the Compliance Data Administrator in Azure Active Directory (Azure AD)
- B. the Active remediation actions role in Microsoft Defender for Endpoint Correct
- C. the Security Administrator role in Azure Active Directory (Azure AD)
- D. the Security Reader role in Azure Active Directory (Azure AD) Correct
Explanation
The Security Reader role in Azure AD (Microsoft Entra ID) gives the analyst read-only access to the security portal, which is the least-privileged way to sign in and view incidents and the Action center. Approving or rejecting pending automated investigation actions requires the Defender for Endpoint RBAC permission Active remediation actions, granted through a Defender for Endpoint role. Security Administrator would also work but grants far more rights than needed, and Compliance Data Administrator is unrelated to remediation actions.
