Assigning the Microsoft Sentinel Responder role so a user can investigate incidents under least privilege
Configure the Microsoft Sentinel SIEM and platform
Answer
Correct answer: A — Microsoft Sentinel Responder is the least-privilege role that can investigate incidents (view, update status, add comments) without configuration rights.
You have an Azure subscription that contains a Microsoft Sentinel workspace named Workspace1 and a user named User1. You need to ensure that User1 can investigate incidents by using Workspace1. The solution must follow the principle of least privilege. Which role should you assign to User1?
Community Votes
55% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
Investigating incidents (viewing details, updating status, adding comments) requires the Responder role; Reader is read-only and cannot progress an investigation, while Contributor/Operator grant unneeded configuration or response rights.
User1 must investigate Sentinel incidents with least privilege; the Microsoft Sentinel Responder role grants view, status-update, and comment rights on incidents without granting configuration permissions.
Choosing Reader because investigating 'sounds like viewing' — Reader cannot update incident status or add comments, both of which investigation requires, so Responder is the least-privilege role that can actually investigate.
Community Discussion (8 comments)
Kristiannn
👍 10
Selected: D
You can investigate by just viewing the Incident. The question does not specify that the user "manage" the Incident.
Onimole
👍 1
Selected: A
Prerequisites The Microsoft Sentinel Responder role assignment is required to investigate incidents. Learn more about roles in Microsoft Sentinel. If you have a guest user that needs to assign incidents, the user must be assigned the Directory Reader role in your Microsoft Entra tenant. Regular (nonguest) users have this role assigned by default. https://learn.microsoft.com/en-us/azure/sentinel/investigate-incidents
limpan
👍 1
Selected: A
A. Microsoft Sentinel Responder Explanation: Microsoft Sentinel Responder: This role allows User1 to investigate incidents, including viewing incidents, updating their status, and adding comments. It does not grant permissions to create or modify analytics rules, playbooks, or other configurations, which aligns with the principle of least privilege. Why not the other options? B. Microsoft Sentinel Contributor: This role grants full access to manage Microsoft Sentinel, including creating and modifying analytics rules, playbooks, and other configurations, which exceeds the required permissions. C. Microsoft Sentinel Automation Contributor: This role is used to manage automation rules and playbooks, not for investigating incidents. D. Microsoft Sentinel Reader: This role only allows viewing incidents and data but does not permit User1 to investigate or update incidents. Thus, the correct answer is A.
b174f8f
👍 1
Selected: A
In Topic 4 Question 29 has a similar case, where “investigate” is required only. It is also marked as requiring the “Respond” role. Here Microsoft specifies that “investigate” requires the role of “respond”: https://learn.microsoft.com/en-us/azure/sentinel/investigate-incidents I think its a bad use of the word, and they shouldn't leave questions open to the imagination, but I'm going to go with A.
xRiot007
👍 1
Selected: A
If you just need to investigate, read rights are enough. If you need to actually investigate and respond/solve the incident, you need to be a Responder.
Takakage
👍 4
Selected: A
The problem statement mentions that "User1 can investigate incidents using Workspace1." If it is just "investigation," it is possible with the Microsoft Sentinel Reader role. However, investigating incidents typically involves checking the details of the incident and, if necessary, changing the status of the incident or adding comments. These actions require the Microsoft Sentinel Responder role.
chirva
👍 3
Selected: A
GPT4: The "Microsoft Sentinel Reader" role provides read-only access to Microsoft Sentinel resources, which includes viewing incidents, workbooks, and other data. However, it does not provide the necessary permissions to actively investigate or respond to incidents. For User1 to be able to investigate incidents, they need more than just read access; they need the ability to interact with and manage incidents. Therefore, the "Microsoft Sentinel Reader" role would not be sufficient for this purpose. The correct role to assign to User1 to ensure they can investigate incidents while adhering to the principle of least privilege is: A. Microsoft Sentinel Responder
sapphire
👍 1
Selected: A
To investigate the incident, read privileges are sufficient. Microsoft Sentinel Reader
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
In Sentinel RBAC, the Responder role is the least-privilege role that can investigate incidents: it can view incidents, update their status, and add comments, but it cannot create or modify analytics rules, playbooks, or other workspace configuration. That matches the 'investigate' requirement and the least-privilege constraint.Why the Other Options Are Wrong
Microsoft Sentinel Reader (D) is read-only and cannot change incident status or comment, so it cannot perform a full investigation. Microsoft Sentinel Contributor (B) can manage workspace content such as analytics rules and playbooks, which exceeds what investigation needs. Microsoft Sentinel Automation Contributor (C) is scoped to automation and playbooks, not incident investigation.Community Comment Notes
Onimole and limpan cite https://learn.microsoft.com/en-us/azure/sentinel/roles and the investigate-incidents page, both stating the Responder role is required to investigate incidents. Kristiannn argues Reader is enough because the question only says 'investigate', but the official role definition treats investigation as including status updates and comments, which Reader cannot do.Official Reference
Related Analysis
Practice All SC-200 Questions
Access 80 questions with complete answers and detailed explanations.
View Full SC-200 Practice Test →