Least privilege role to review Identity Protection risky users

Why the Answer Is Correct

Security Administrator (C) is the correct least-privilege role among the available options because it can review the Azure AD Identity Protection list of users flagged for risk without granting full tenant control. Microsoft's built-in role guidance grants Identity Protection read access to Security Reader, Global Reader, Security Administrator, and Global Administrator; with Security Reader and Global Reader absent, Security Administrator is the closest least-privileged match. Although Security Administrator can also manage security settings, its read capability for risky users satisfies the requirement, and no lower-privileged option in this list provides that access. Choosing Global Administrator would violate least privilege because it can manage every aspect of the Microsoft 365 tenant. Therefore C meets the question's intent.

Why the Other Options Are Wrong

A. Global Administrator grants full control over the tenant and all security features, which far exceeds the read-only review requirement and breaks least privilege. B. Service Administrator manages service requests, billing, and support tickets; it has no access to Identity Protection risky users or security reports. D. Reports Reader can read sign-in and audit reports and Office 365 usage reports, but it does not include the Azure AD Identity Protection risky users list; learners often confuse it with the Security Reader role, which is the actual read-only security role. Because Security Reader is not offered, the next least-privileged role that can review flagged users is Security Administrator. This is why C is the intended answer.

Community Comment Notes

As solderboy noted, the risky sign-ins reports are available to Security Administrator, Global Administrator, and Security Reader, and the question appears in multiple versions where Security Reader is sometimes an option. APK1 pointed out that since there is "no Security Reader provided in the answers list," Security Administrator becomes the correct answer and that Reports Reader "is not Security Reader." Ody shared a hands-on claim that a Reports Reader can "review and download the risk reports" after logging into Entra ID, but the official built-in role definitions reserve Identity Protection read access for Security Reader, not Reports Reader. The overwhelming community vote for C reflects the least-privilege interpretation when Security Reader is missing. So the community consensus supports the selected answer.