Assigning Security Operator to Group1 and Copilot Contributor to Group2 for least-privilege Copilot and incident response

SC-200 By islever Editorial Last updated

Short answer

AE Group1 needs Security Operator for incident response and Group2 needs Copilot Contributor to prompt, both at minimum privilege.

Question

You have a Microsoft 365 E5 subscription that contains two groups named Group1 and Group2 and uses Microsoft Copilot for Security. You need to configure Copilot for Security role assignments to meet the following requirements: • Ensure that members of Group1 can run prompts and respond to Microsoft Defender XDR security incidents. • Ensure that members of Group2 can run prompts. • Follow the principle of least privilege. You remove Everyone from the Copilot Contributor role. Which two actions should you perform next? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point.
  1. Assign the Security Operator role to Group1. Correct Answer
  2. Assign the Copilot Owner role to Group2.
  3. Assign the Copilot Owner role to Group1
  4. Assign the Security Operator role to Group2.
  5. Assign the Copilot Contributor role to Group2. Correct Answer

Key Takeaways

Copilot for Security prompting requires the Copilot Contributor (or higher) role, while responding to Microsoft Defender XDR incidents requires the Defender XDR Security Operator role; assigning each group only what it needs satisfies least privilege.

With Everyone removed from Copilot Contributor, Group1 (run prompts + respond to Defender XDR incidents) gets the Security Operator role for incident response, and Group2 (run prompts only) gets Copilot Contributor, meeting least privilege with these two assignments.

Common mistake: Assigning Copilot Owner to either group — Owner is broader than needed for prompting and incident response, violating least privilege after Everyone was removed from Contributor.

Expert Analysis

Why the Answer Is Correct

Group1 must both run Copilot for Security prompts and respond to Defender XDR incidents; the Security Operator role grants Defender XDR incident response, and (together with the Copilot prompt ability) covers Group1's needs. Group2 only needs to run prompts, so Copilot Contributor is the least-privilege role for it. These two assignments (A and E) implement least privilege.

Why the Other Options Are Wrong

Assigning Copilot Owner to Group1 (C) or Group2 (B) grants excessive permissions beyond prompting/incident response. Assigning Security Operator to Group2 (D) gives incident-response rights Group2 does not need. The community consensus is A and E.

Community Comment Notes

Swethag37 (6 likes) breaks down the requirements and confirms A and E. Blasty notes the true least-privilege set would also add Copilot Contributor to Group1, but among the given options A and E are the two correct picks. chiquito also confirms A and E from the assign-roles documentation.

Official Reference

https://learn.microsoft.com/en-us/copilot/security/authentication#assign-roles

This link opens the official vendor documentation in a new tab.

Community Votes

AE
78%
CE
22%

78% of anonymous learners picked answer AE. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 3 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 3

  1. Swethag37 👍 6
    Explanation: To follow the principle of least privilege, we must carefully assign roles based on minimum necessary permissions. Requirement Breakdown: Group1 needs to run prompts AND respond to Microsoft Defender XDR security incidents. Solution: Assign the Security Operator role. The Security Operator role allows responding to Microsoft Defender XDR incidents. This role provides incident response privileges, but not full administrative rights. Group2 needs to run prompts ONLY. Solution: Assign the Copilot Contributor role. This role allows running prompts without elevated security permissions.
  2. chiquito 👍 2
    Answers are correct https://learn.microsoft.com/en-us/copilot/security/authentication#assign-roles
  3. Blasty 👍 1
    Correct answer is not included imo. It should be A, E, (F): - Assign Security Operator to Group1 (to get access to Defender XDR incident data) - Assign Copilot Contributor to Group1 (to be able to prompt) - Assign Copilot Contributor to Group2 (to be able to prompt) Silly question though, since Group2 doesn't have any rights to access M365 data/Azure data since they only have the Contributor role

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Creating a Microsoft Sentinel bookmark from the Hunting page to support an incident investigation

S-grade

Identifying Affected Entities in Microsoft Defender XDR Incidents

S-grade

Containing a Defender for Identity pass-the-ticket alert by quarantining only the affected device

S-grade

Limiting Microsoft Defender device discovery to specific onboarded devices by creating a device tag first

S-grade

Practice All SC-200 Questions

Access 80 questions with complete answers and detailed explanations.

View Full SC-200 Practice Test →

← Back to SC-200 Study Guide