Assigning Workbook Contributor so a user can deploy and customize Sentinel workbook templates under least privilege

Configure the Microsoft Sentinel SIEM and platform
Answer Correct answer: B — Workbook templates require the Azure Monitor Workbook Contributor role; Sentinel Contributor alone cannot deploy templates.

You have an Azure subscription that contains a resource group named RG1. RG1 contains a Microsoft Sentinel workspace. The subscription is linked to a Microsoft Entra tenant that contains a user named User1. You need to ensure that User1 can deploy and customize Microsoft Sentinel workbook templates. The solution must follow the principle of least privilege. Which role should you assign to User1 for RG1?

  1. Microsoft Sentinel Contributor
  2. Workbook Contributor Correct Answer
  3. Microsoft Sentinel Automation Contributor
  4. Contributor
sentinel workbook contributor workbook templates role azure monitor workbook contributor

Community Votes

B
71%
A
29%

71% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.

Community Insight

Managing workbook templates requires the Azure Monitor Workbook Contributor role (Microsoft.Insights/workbooks/ and workbooktemplates/); Microsoft Sentinel Contributor alone does not grant template management, so Workbook Contributor is the precise least-privilege role.

To let User1 deploy and customize Microsoft Sentinel workbook templates on RG1 under least privilege, assign the Workbook Contributor (Azure Monitor) role, which grants the workbook write/delete/template permissions without broader access.

Assigning Microsoft Sentinel Contributor — it manages Sentinel content but does not grant workbook template deployment; you still need the Workbook Contributor Azure Monitor role for templates.

Community Discussion (8 comments)

Vokuhila 👍 9 Selected: B
correct answer
threshclo 👍 7 Selected: A
To create and delete a Microsoft Sentinel workbook, the user needs either the Microsoft Sentinel Contributor role or a lesser Microsoft Sentinel role, together with the Workbook Contributor Azure Monitor role.
a_kto_to 👍 1 Selected: B
https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles/monitor#workbook-contributor
dnt91 👍 3 Selected: B
To manage TEMPLATES (not only workbook), you need the Workbook Contributor Role, not the Sentinel Contributor Role which help managing workbooks (not templates)
Itsmebigal 👍 3 Selected: B
Actions Description Microsoft.Insights/workbooks/write Create or update a workbook Microsoft.Insights/workbooks/delete Delete a workbook Microsoft.Insights/workbooks/read Read a workbook Microsoft.Insights/workbooks/revisions/read Get the workbook revisions Microsoft.Insights/workbooktemplates/write Create or update a workbook template Microsoft.Insights/workbooktemplates/delete Delete a workbook template Microsoft.Insights/workbooktemplates/read Read a workbook template https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles/monitor#workbook-contributor
barneyone 👍 1 Selected: B
Correct answer
choukou 👍 1
B---->ok
dyavlito 👍 4
Answer: B. Workbook Contributor Explanation: Workbook Contributor role grants the required permissions to deploy and customize workbook templates in Microsoft Sentinel. It provides the ability to create and modify workbooks without granting broader permissions that are not needed for this task. The other roles provide broader access or different functionalities that are not necessary for just working with workbook templates: A. Microsoft Sentinel Contributor grants broader permissions across Microsoft Sentinel but is not required solely for workbook templates. C. Microsoft Sentinel Automation Contributor is focused on automating tasks and is unrelated to workbooks. D. Contributor grants full access to manage all resources in the resource group, which is more access than needed. Therefore, Workbook Contributor is the best choice for this scenario.

Comments & Corrections

No comments yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

Expert Analysis

Why the Answer Is Correct

Deploying and customizing Microsoft Sentinel workbook templates requires the Azure Monitor Workbook Contributor role, which provides Microsoft.Insights/workbooks/write, /delete, /read, and workbooktemplates/write permissions. Assigning it scoped to RG1 satisfies the task at minimum privilege without granting broader subscription or Sentinel configuration rights.

Why the Other Options Are Wrong

Microsoft Sentinel Contributor (A) manages Sentinel analytics rules, playbooks, and workbooks but does not grant workbook template deployment. Microsoft Sentinel Automation Contributor (C) is scoped to automation/playbooks. The blanket Contributor (D) grants full control over all RG1 resources, far exceeding what workbook template management needs.

Community Comment Notes

dnt91 and Itsmebigal explain that TEMPLATES specifically need Workbook Contributor, not Sentinel Contributor, which only manages existing workbooks. Vokuhila, dyavlito, and a_kto_to confirm B with the Azure Monitor built-in role documentation.

Official Reference

https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles/monitor#workbook-contributor

Related Analysis

You have a Microsoft 365 E5 subscription that uses Microsoft

A-Grade

You have a Microsoft 365 subscription that uses Microsoft De

S-Grade

You have a Microsoft 365 E5 subscription that contains a dev

S-Grade

Practice All SC-200 Questions

Access 80 questions with complete answers and detailed explanations.

View Full SC-200 Practice Test →

← Back to SC-200 Study Guide