Assigning the Microsoft Sentinel Responder role so a user can investigate incidents under least privilege

SC-200 By islever Editorial Last updated

Configure the Microsoft Sentinel SIEM and platform

Short answer

A Microsoft Sentinel Responder is the least-privilege role that can investigate incidents (view, update status, add comments) without configuration rights.

Question

You have an Azure subscription that contains a Microsoft Sentinel workspace named Workspace1 and a user named User1. You need to ensure that User1 can investigate incidents by using Workspace1. The solution must follow the principle of least privilege. Which role should you assign to User1?
  1. Microsoft Sentinel Responder Correct Answer
  2. Microsoft Sentinel Contributor
  3. Microsoft Sentinel Automation Contributor
  4. Microsoft Sentinel Reader

Key Takeaways

Investigating incidents (viewing details, updating status, adding comments) requires the Responder role; Reader is read-only and cannot progress an investigation, while Contributor/Operator grant unneeded configuration or response rights.

User1 must investigate Sentinel incidents with least privilege; the Microsoft Sentinel Responder role grants view, status-update, and comment rights on incidents without granting configuration permissions.

Common mistake: Choosing Reader because investigating 'sounds like viewing' — Reader cannot update incident status or add comments, both of which investigation requires, so Responder is the least-privilege role that can actually investigate.

Expert Analysis

Why the Answer Is Correct

In Sentinel RBAC, the Responder role is the least-privilege role that can investigate incidents: it can view incidents, update their status, and add comments, but it cannot create or modify analytics rules, playbooks, or other workspace configuration. That matches the 'investigate' requirement and the least-privilege constraint.

Why the Other Options Are Wrong

Microsoft Sentinel Reader (D) is read-only and cannot change incident status or comment, so it cannot perform a full investigation. Microsoft Sentinel Contributor (B) can manage workspace content such as analytics rules and playbooks, which exceeds what investigation needs. Microsoft Sentinel Automation Contributor (C) is scoped to automation and playbooks, not incident investigation.

Community Comment Notes

Onimole and limpan cite https://learn.microsoft.com/en-us/azure/sentinel/roles and the investigate-incidents page, both stating the Responder role is required to investigate incidents. Kristiannn argues Reader is enough because the question only says 'investigate', but the official role definition treats investigation as including status updates and comments, which Reader cannot do.

Official Reference

https://learn.microsoft.com/en-us/azure/sentinel/roles

This link opens the official vendor documentation in a new tab.

Community Votes

A
55%
D
45%

55% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 8 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 8

  1. Kristiannn 👍 10 Answered D
    You can investigate by just viewing the Incident. The question does not specify that the user "manage" the Incident.
  2. Takakage 👍 4 Answered A
    The problem statement mentions that "User1 can investigate incidents using Workspace1." If it is just "investigation," it is possible with the Microsoft Sentinel Reader role. However, investigating incidents typically involves checking the details of the incident and, if necessary, changing the status of the incident or adding comments. These actions require the Microsoft Sentinel Responder role.
  3. chirva 👍 3 Answered A
    GPT4: The "Microsoft Sentinel Reader" role provides read-only access to Microsoft Sentinel resources, which includes viewing incidents, workbooks, and other data. However, it does not provide the necessary permissions to actively investigate or respond to incidents. For User1 to be able to investigate incidents, they need more than just read access; they need the ability to interact with and manage incidents. Therefore, the "Microsoft Sentinel Reader" role would not be sufficient for this purpose. The correct role to assign to User1 to ensure they can investigate incidents while adhering to the principle of least privilege is: A. Microsoft Sentinel Responder
  4. limpan 👍 1 Answered A
    A. Microsoft Sentinel Responder Explanation: Microsoft Sentinel Responder: This role allows User1 to investigate incidents, including viewing incidents, updating their status, and adding comments. It does not grant permissions to create or modify analytics rules, playbooks, or other configurations, which aligns with the principle of least privilege. Why not the other options? B. Microsoft Sentinel Contributor: This role grants full access to manage Microsoft Sentinel, including creating and modifying analytics rules, playbooks, and other configurations, which exceeds the required permissions. C. Microsoft Sentinel Automation Contributor: This role is used to manage automation rules and playbooks, not for investigating incidents. D. Microsoft Sentinel Reader: This role only allows viewing incidents and data but does not permit User1 to investigate or update incidents. Thus, the correct answer is A.
  5. Onimole 👍 1 Answered A
    Prerequisites The Microsoft Sentinel Responder role assignment is required to investigate incidents. Learn more about roles in Microsoft Sentinel. If you have a guest user that needs to assign incidents, the user must be assigned the Directory Reader role in your Microsoft Entra tenant. Regular (nonguest) users have this role assigned by default. https://learn.microsoft.com/en-us/azure/sentinel/investigate-incidents
Show 3 more comments
  1. b174f8f 👍 1 Answered A
    In Topic 4 Question 29 has a similar case, where “investigate” is required only. It is also marked as requiring the “Respond” role. Here Microsoft specifies that “investigate” requires the role of “respond”: https://learn.microsoft.com/en-us/azure/sentinel/investigate-incidents I think its a bad use of the word, and they shouldn't leave questions open to the imagination, but I'm going to go with A.
  2. xRiot007 👍 1 Answered A
    If you just need to investigate, read rights are enough. If you need to actually investigate and respond/solve the incident, you need to be a Responder.
  3. sapphire 👍 1 Answered A
    To investigate the incident, read privileges are sufficient. Microsoft Sentinel Reader

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Creating a Microsoft Sentinel bookmark from the Hunting page to support an incident investigation

S-grade

Identifying Affected Entities in Microsoft Defender XDR Incidents

S-grade

Containing a Defender for Identity pass-the-ticket alert by quarantining only the affected device

S-grade

Limiting Microsoft Defender device discovery to specific onboarded devices by creating a device tag first

S-grade

Practice All SC-200 Questions

Access 80 questions with complete answers and detailed explanations.

View Full SC-200 Practice Test →

← Back to SC-200 Study Guide