Least-privilege roles for Microsoft 365 Defender action approvals

SC-200 By islever Editorial Last updated

Respond to alerts and incidents in Microsoft Defender XDR Respond to alerts and incidents in Microsoft Defender for Endpoint

Short answer

BD Assign Security Reader in Azure AD for Microsoft 365 security center access and Active remediation actions in Microsoft Defender for Endpoint to approve or reject MDE pending actions with least privilege.

Question

Your company deploys the following services:
✑ Microsoft Defender for Identity
✑ Microsoft Defender for Endpoint
✑ Microsoft Defender for Office 365
You need to provide a security analyst with the ability to use the Microsoft 365 security center. The analyst must be able to approve and reject pending actions
generated by Microsoft Defender for Endpoint. The solution must use the principle of least privilege.
Which two roles should assign to the analyst? Each correct answer presents part of the solution.
NOTE: Each correct selection is worth one point.
  1. the Compliance Data Administrator in Azure Active Directory (Azure AD)
  2. the Active remediation actions role in Microsoft Defender for Endpoint Correct Answer
  3. the Security Administrator role in Azure Active Directory (Azure AD)
  4. the Security Reader role in Azure Active Directory (Azure AD) Correct Answer

Key Takeaways

The question tests the split between tenant-level read access and workload-specific remediation rights, with the trap that Security Administrator can approve actions but is too broad for least privilege.

This SC-200 scenario tests which roles let a security analyst use the Microsoft 365 security center and approve or reject Defender for Endpoint remediation actions. The least-privilege answer is Security Reader plus the Defender for Endpoint Active remediation actions role (B, D).

Common mistake: Choosing Security Administrator (C) because it can approve actions; it works technically but grants policy and alert-management rights beyond the analyst's task, so it violates least privilege.

Expert Analysis

Two separate permissions are in play. The analyst needs a tenant-level read role that opens the Microsoft 365 security center, and a workload-specific role that authorizes the approve/reject operation on Defender for Endpoint remediation actions. In this question those are D: Security Reader in Azure AD and B: Active remediation actions in Microsoft Defender for Endpoint. Security Reader supplies the view into the security center without granting change rights; Active remediation actions supplies exactly the change right required for MDE-generated pending actions. Neither role alone satisfies both requirements: D is read-only, and B is scoped to MDE remediation rather than general portal administration.

Why not Security Administrator. Option C is technically capable of approving actions, and the Action Center documentation lists Security Administrator as an allowed role for Defender for Endpoint remediation. But the question adds a least-privilege constraint. Security Administrator can update security policies, dismiss alerts, and administer other security settings, so it is broader than an analyst who only needs to review the portal and act on MDE remediation requests. Option A, Compliance Data Administrator, is unrelated to security center investigation and remediation. Comments on this item make the same split: one notes the doc's "Security Administrator or Active remediation actions" path, while another stresses that Security Reader has viewing rights only and cannot make changes. Another comment points out that MDE RBAC can restrict what a reader sees, which is why B must be the role that authorizes the action rather than assuming D can approve it.

What would flip the answer? If the analyst also had to change security policies, dismiss alerts, or administer Defender for Office 365/Identity settings, Security Administrator (C) would become necessary, and the least-privilege argument for D would weaken. Conversely, if the task were only to view pending actions and never approve/reject, D alone would be enough. If the organization disabled MDE RBAC and relied solely on Azure AD roles, the portal access model changes, but the least-privilege answer still avoids C.

Operational consequence. Giving C when B+D is intended violates least privilege and creates an over-privileged analyst who can alter policies beyond remediation. Giving D without B leaves the analyst able to see the queue but unable to approve or reject, blocking incident response. B+D is the narrowest pair that lets the analyst open the security center and complete MDE action-center decisions.

Official Reference

https://learn.microsoft.com/en-us/microsoft-365/security/defender/m365d-action-center?view=o365-worldwide

This link opens the official vendor documentation in a new tab.

Exam Strategy

When an SC-200 item pairs "use the portal" with "approve/reject actions" and adds least privilege, separate read access from action rights. Look for a read-only Azure AD role for the portal and a workload-scoped role for the operation, then eliminate any role that bundles policy administration. Treat Security Administrator as a distractor when a narrower Defender for Endpoint role exists; only select it if the scenario explicitly requires policy changes or tenant-wide security administration.

Frequently Asked Questions

Does Security Reader allow approving Defender for Endpoint actions?

No. Security Reader grants read-only access to security information; approving or rejecting MDE remediation actions requires the Active remediation actions role (or a broader admin role such as Security Administrator).

Why isn't Security Administrator the least-privilege answer?

It can approve actions, but it also permits policy updates, alert dismissal and other tenant-wide security administration, which exceeds an analyst's approve/reject requirement.

What if the analyst only needs to view pending actions?

Then Security Reader alone is sufficient for read-only access, but the scenario requires approve and reject, so B is also needed.

More SC-200 FAQ →

Community Votes

B
50%
D
35%
C
15%

50% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 28 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 28

  1. PhilAus 👍 29
    Provided answer B and D is correct. Security Reader - can access M365 Security Center. Active Remediation Actions role in Defender for Endpoint meets need to 'approve and reject' pending actions with respect to Defender For Endpoint. Requirement does not need more.
  2. Metasploit 👍 12
    This question is tricky. If you follow the question directly, they are not asking either/or. They want you to assign 2 roles to the Analyst each being half of the entire solution. Using least privileges the answer should be BD. Not A = Too many other permissions not needed. B = the Active remediation actions role in Microsoft Defender for Endpoint is enough for the task to be done of approving/rejecting pending actions. Not C = Would be able to fulfill both B and D and (more), not least privilege. D = Quite redundant, but gives reader roles read access to the portal up until RBAC is turned on the defender permissions. Least Privilege. ¯\_(ツ)_/¯
  3. TOMtheBOMB 👍 5
    Slight confused by this one, this link suggests the answer is B & C: https://docs.microsoft.com/en-us/microsoft-365/security/defender/m365d-action-center?view=o365-worldwide Remediation action: Microsoft Defender for Endpoint remediation (devices) Required roles and permissions: Security Administrator role assigned in either Azure Active Directory (Azure AD) (https://portal.azure.com) or the Microsoft 365 admin center (https://admin.microsoft.com) --- or --- Active remediation actions role assigned in Microsoft Defender for Endpoint
  4. jasonfmj 👍 4
    Answer is B and C Security Reader: A user that belongs to this role has viewing rights to Security Center. The user can view recommendations, alerts, a security policy, and security states, but cannot make changes. Security Admin: A user that belongs to this role has the same rights as the Security Reader and can also update the security policy and dismiss alerts and recommendations. https://docs.microsoft.com/en-us/azure/security-center/security-center-permissions
  5. AlaReAla 👍 4
    Option C will not follow the least prervilige principle. Further, this role is more for administration stuff like editing or deleting roles etc. Checkout the below URL for more info: https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/user-roles?view=o365-worldwide
Show 23 more comments
  1. TomasValtor 👍 3
    The answer should be : B and C Check this article: https://learn.microsoft.com/en-us/microsoft-365/security/defender/m365d-action-center?view=o365-worldwide Tip Users who have the Global Administrator role assigned in Azure AD can approve or reject any pending action in the Action center. However, as a best practice, your organization should limit the number of people who have the Global Administrator role assigned. We recommend using the Security Administrator, Active remediation actions, and Search and Purge roles listed in the preceding table for Action center permissions.
  2. Oryx360 👍 3
    Reason being that you do not need a Reader Role. The Active remediation actions role in Microsoft Defender for Endpoint: This role grants the analyst the ability to take active remediation actions, which includes approving and rejecting pending actions in Microsoft Defender for Endpoint. The Security Administrator role in Azure Active Directory (Azure AD): While not specific to Defender for Endpoint, this role provides broad access to security-related tasks and configuration across Microsoft 365 services, aligning with the analyst's responsibilities.
  3. kakakayayaya 👍 3
    Active remediation actions role in MDE portal is enough for approve and reject pending actions generated by Microsoft Defender for Endpoint. As soon as you enable Active remediation actions role, Security Reader role is not work in MDE portal. If you don't enable RBAC in MDE portal you can use Security Reader to access.
  4. Andreew883 👍 3
    B and D are correct. Minimum privilege is requested. The other two options are for administrators.
  5. uday1985 👍 3
    does PoLP mean anything to you?
  6. Nikki0222 👍 3
    BD correct
  7. danb67 👍 2
    B is not enough to approve/reject email related pending actions though is it? https://learn.microsoft.com/en-us/microsoft-365/security/defender/m365d-action-center?view=o365-worldwide So a user assigned only the active remediation roles will not be able to approve or reject email related pending actions. So answer is BC
  8. WORKTRAIN 👍 2
    You are right. But the question states "The analyst must be able to approve and reject pending actions generated by Microsoft Defender for Endpoint", so we don't have to take in consideration the other defender components. B and D are the correct answers.
  9. TomG 👍 2
    Given answers are correct
  10. liberty123 👍 2
    B and D is correct
  11. Tx4free 👍 2
    Correct answer
  12. neogeek87 👍 1
    The correct answers are: B. Active remediation actions role in Microsoft Defender for Endpoint D. Security Reader role in Azure Active Directory (Microsoft Entra ID) Why: The analyst needs read access to the Microsoft 365 security experience, while the Active remediation actions permission provides the ability to approve or reject remediation actions. This combination follows least privilege rather than granting the broader Security Administrator role. Microsoft’s documentation describes the Action center as supporting“Approving pending remediation actions” and notes that access requires the appropriate permissions. Answer: B and D
  13. 1a144a0 👍 1
    B. the Active remediation actions role in Microsoft Defender for Endpoint: This role specifically allows the analyst to approve or reject pending remediation actions in Microsoft Defender for Endpoint, which is the primary requirement. D. the Security Reader role in Azure Active Directory (Azure AD): This role provides the analyst with read-only access to security-related information in the Microsoft 365 security center without granting unnecessary administrative privileges. It supports the principle of least privilege by restricting the analyst's permissions to what is necessary for their role.
  14. HSBNZ 👍 1
    The correct answer it is seems like, as steps for to Create an indicator for files from the settings page 1. In the navigation pane, select Settings > Endpoints > Indicators (under Rules). 2. Select the File hashes tab. 3. Select Add indicator. 4. Specify the following details: 5. Indicator - Specify the entity details and define the expiration of the indicator. Action - Specify the action to be taken and provide a description. Scope - Define the scope of the device group. * Review the details in the Summary tab, then select Save.
  15. Holii 👍 1
    The link says it right there: --- or --- Active remediation actions role assigned in Microsoft Defender for Endpoint Security Administrator has too many additional roles outside of simply approving/rejecting pending actions. This would breach Least Privilege. Read-only permissions don't have access to the MDE portal once RBAC is enabled in MDE. So you have to enable this role for Security Reader to access. Security Reader will provide a read-only view into the policies.
  16. BenLam 👍 1
    https://learn.microsoft.com/en-us/defender-xdr/m365d-action-center It clearly says here active remediation and security admin. Security reader won't be able to perform such actions.
  17. Ramye 👍 1
    Yes, but this sec admin will only take actions on alerts that are coming from MDI and has sufficient permission for that, will that not suffice?
  18. HSBNZ 👍 1
    Please don't approve this and the previous comment here on this question, as it is a mistake. Meant to comment on the above question. Ta.
  19. Xyz_40 👍 1
    BC is the correct answer. in D, he would not be able to perform anything but just to view
  20. Avaris 👍 1
    the security admin should be able to do more while sec reader can't do these action
  21. paraze 👍 1
    Security Reader is enough, Security Administrator not needed. Least Priviledge. BD
  22. Harold_Finch 👍 1
    Not C - Using principle of least privileges, B & D would be the right choices.
  23. chepeerick 👍 1
    Options B and D

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Creating a Microsoft Sentinel bookmark from the Hunting page to support an incident investigation

S-grade

Containing a Defender for Identity pass-the-ticket alert by quarantining only the affected device

S-grade

Limiting Microsoft Defender device discovery to specific onboarded devices by creating a device tag first

S-grade

Assigning the Microsoft Sentinel Responder role so a user can investigate incidents under least privilege

S-grade

Practice All SC-200 Questions

Access 80 questions with complete answers and detailed explanations.

View Full SC-200 Practice Test →

← Back to SC-200 Study Guide