Assigning Workbook Contributor so a user can deploy and customize Sentinel workbook templates under least privilege

SC-200 By islever Editorial Last updated

Configure the Microsoft Sentinel SIEM and platform

Short answer

B Workbook templates require the Azure Monitor Workbook Contributor role; Sentinel Contributor alone cannot deploy templates.

Question

You have an Azure subscription that contains a resource group named RG1. RG1 contains a Microsoft Sentinel workspace. The subscription is linked to a Microsoft Entra tenant that contains a user named User1. You need to ensure that User1 can deploy and customize Microsoft Sentinel workbook templates. The solution must follow the principle of least privilege. Which role should you assign to User1 for RG1?
  1. Microsoft Sentinel Contributor
  2. Workbook Contributor Correct Answer
  3. Microsoft Sentinel Automation Contributor
  4. Contributor

Key Takeaways

Managing workbook templates requires the Azure Monitor Workbook Contributor role (Microsoft.Insights/workbooks/ and workbooktemplates/); Microsoft Sentinel Contributor alone does not grant template management, so Workbook Contributor is the precise least-privilege role.

To let User1 deploy and customize Microsoft Sentinel workbook templates on RG1 under least privilege, assign the Workbook Contributor (Azure Monitor) role, which grants the workbook write/delete/template permissions without broader access.

Common mistake: Assigning Microsoft Sentinel Contributor — it manages Sentinel content but does not grant workbook template deployment; you still need the Workbook Contributor Azure Monitor role for templates.

Expert Analysis

Why the Answer Is Correct

Deploying and customizing Microsoft Sentinel workbook templates requires the Azure Monitor Workbook Contributor role, which provides Microsoft.Insights/workbooks/write, /delete, /read, and workbooktemplates/write permissions. Assigning it scoped to RG1 satisfies the task at minimum privilege without granting broader subscription or Sentinel configuration rights.

Why the Other Options Are Wrong

Microsoft Sentinel Contributor (A) manages Sentinel analytics rules, playbooks, and workbooks but does not grant workbook template deployment. Microsoft Sentinel Automation Contributor (C) is scoped to automation/playbooks. The blanket Contributor (D) grants full control over all RG1 resources, far exceeding what workbook template management needs.

Community Comment Notes

dnt91 and Itsmebigal explain that TEMPLATES specifically need Workbook Contributor, not Sentinel Contributor, which only manages existing workbooks. Vokuhila, dyavlito, and a_kto_to confirm B with the Azure Monitor built-in role documentation.

Official Reference

https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles/monitor#workbook-contributor

This link opens the official vendor documentation in a new tab.

Community Votes

B
71%
A
29%

71% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 7 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 7

  1. threshclo 👍 7 Answered A
    To create and delete a Microsoft Sentinel workbook, the user needs either the Microsoft Sentinel Contributor role or a lesser Microsoft Sentinel role, together with the Workbook Contributor Azure Monitor role.
  2. dyavlito 👍 4
    Answer: B. Workbook Contributor Explanation: Workbook Contributor role grants the required permissions to deploy and customize workbook templates in Microsoft Sentinel. It provides the ability to create and modify workbooks without granting broader permissions that are not needed for this task. The other roles provide broader access or different functionalities that are not necessary for just working with workbook templates: A. Microsoft Sentinel Contributor grants broader permissions across Microsoft Sentinel but is not required solely for workbook templates. C. Microsoft Sentinel Automation Contributor is focused on automating tasks and is unrelated to workbooks. D. Contributor grants full access to manage all resources in the resource group, which is more access than needed. Therefore, Workbook Contributor is the best choice for this scenario.
  3. Itsmebigal 👍 3 Answered B
    Actions Description Microsoft.Insights/workbooks/write Create or update a workbook Microsoft.Insights/workbooks/delete Delete a workbook Microsoft.Insights/workbooks/read Read a workbook Microsoft.Insights/workbooks/revisions/read Get the workbook revisions Microsoft.Insights/workbooktemplates/write Create or update a workbook template Microsoft.Insights/workbooktemplates/delete Delete a workbook template Microsoft.Insights/workbooktemplates/read Read a workbook template https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles/monitor#workbook-contributor
  4. dnt91 👍 3 Answered B
    To manage TEMPLATES (not only workbook), you need the Workbook Contributor Role, not the Sentinel Contributor Role which help managing workbooks (not templates)
  5. a_kto_to 👍 1 Answered B
    https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles/monitor#workbook-contributor
Show 2 more comments
  1. Vokuhila 👍 9 Answered B
    correct answer
  2. choukou 👍 1
    B---->ok

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Creating a Microsoft Sentinel bookmark from the Hunting page to support an incident investigation

S-grade

Identifying Affected Entities in Microsoft Defender XDR Incidents

S-grade

Containing a Defender for Identity pass-the-ticket alert by quarantining only the affected device

S-grade

Limiting Microsoft Defender device discovery to specific onboarded devices by creating a device tag first

S-grade

Practice All SC-200 Questions

Access 80 questions with complete answers and detailed explanations.

View Full SC-200 Practice Test →

← Back to SC-200 Study Guide