MCRA Job Role Security Level Configuration

SC-100 By islever Editorial Last updated

Design solutions that align with the Microsoft Cybersecurity Reference Architectures (MCRA) and Microsoft Cloud Security Benchmark (MCSB)

Short answer

Configure Developers at the Specialized Account security level and Administrators at the Privileged Account security level.

Question

HOTSPOT
You are planning the security levels for a security access strategy.
You need to identify which job roles to configure at which security levels. The solution must meet security best practices of the Microsoft Cybersecurity Reference Architectures (MCRA).
Which security level should you configure for each job role? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Exhibit: MCRA Job Role Security Level Configuration

Key Takeaways

The exam requires knowledge of the specific MCRA PowerPoint deck slide that maps Developer and Admin roles to Privileged or Specialized account types, a detail often updated in recent exam versions.

This question tests the mapping of job roles to security levels within the Microsoft Cybersecurity Reference Architecture (MCRA). The correct configuration aligns with MCRA best practices for privileged and specialized access.

Common mistake: Candidates often confuse 'Privileged' and 'Specialized' accounts or assume all administrators require the highest privilege level, failing to distinguish between standard admin duties and highly sensitive privileged operations as defined by MCRA.

Expert Analysis

Why the Answer Is Correct

The solution is derived directly from the Microsoft Cybersecurity Reference Architectures (MCRA) documentation. According to the MCRA framework, job roles are segmented into specific security levels to enforce least privilege. Typically, general developers are mapped to Specialized Accounts, while system administrators are mapped to Privileged Accounts, reflecting the higher risk associated with administrative tasks.

Why Other Candidate Answers Are Wrong

Incorrect selections usually stem from applying generic ITIL or traditional AD concepts rather than the specific MCRA taxonomy. Assigning developers to Privileged Accounts violates the principle of separation of duties and increases the attack surface unnecessarily. Conversely, placing admins in Specialized Accounts may fail to provide necessary audit trails for high-risk actions required by the architecture.

Community Comment Notes

Community consensus strongly points to specific slides in the official MCRA PowerPoint deck. As noted by user Jacquesvz, referencing page 59 (or later pages like 84/100 in updated versions) provides the exact mapping. User dsatizabal highlights a common confusion where both devs and admins appear on specialized accounts in older versions, emphasizing the need for the latest exam materials. Another commenter, God2029, attributes the ease of the question to insider threat logic, which underpins the MCRA design.

Official Reference

https://learn.microsoft.com/en-us/security/cybersecurity-reference-architecture/mcra

This link opens the official vendor documentation in a new tab.

Exam Strategy

Memorize the role-to-account mappings from the latest MCRA PowerPoint deck, paying attention to page numbers that change with exam updates. Focus on distinguishing between 'Privileged' (high trust, broad access) and 'Specialized' (limited scope, task-specific) account requirements for Developers vs. Administrators.

Frequently Asked Questions

Where can I find the MCRA role mapping?

The mapping is detailed in the Microsoft Cybersecurity Reference Architectures (MCRA) PowerPoint deck, typically on slides ranging from 59 to 100 depending on the version.

Why are developers not privileged accounts?

Developers do not require broad administrative control over production environments; assigning them to specialized accounts enforces the principle of least privilege and reduces insider threat risk.

More SC-100 FAQ →

Discussion 9 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 9

  1. Jacquesvz 👍 18
    Correct Answer: reference = https://learn.microsoft.com/en-us/security/cybersecurity-reference-architecture/mcra (check page 59 of the MCRA powerpoint deck)
  2. lt9898 👍 4
    Now on slide 84 as of the Dec 2023 update
  3. TopicExam224 👍 2
    Answers are correct, in the exam on 26 Nov 2025
  4. TomasValtor 👍 2
    check page 60 of the MCRA powerpoint deck
  5. dsatizabal 👍 1
    The only problem with slide 84 of MCRA PPT is that devs and admins show both on specialized and privileged accounts
Show 4 more comments
  1. TomasValtor 👍 1
    https://learn.microsoft.com/en-us/security/cybersecurity-reference-architecture/mcra
  2. [email protected] 👍 1
    Correct Answer. Slide 100 as of april 2025 version
  3. God2029 👍 1
    An Easy pick, based on the insider threat logic
  4. billo79152718 👍 1
    Correct. Thanks.

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Using Microsoft Entra Permissions Management to find unused RBAC assignments

S-grade

Scenarios supported by compliant network check in Global Secure Access

S-grade

Removing the inbound firewall rule for an Entra application proxy connector

S-grade

Changing DNS MX records to route all inbound mail through Defender for Office 365

S-grade

Practice All SC-100 Questions

Access 110 questions with complete answers and detailed explanations.

View Full SC-100 Practice Test →

← Back to SC-100 Study Guide