Identity Secure Score Update Permissions in Microsoft Entra ID

Plan and implement privileged access

Answer Correct answer: B — Assigning the User Administrator role does not meet the goal because it lacks permission to update Identity Secure Score improvement actions.

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have a Microsoft 365 E5 subscription. You create a user named User1. You need to ensure that User1 can update the status of Identity Secure Score improvement actions. Solution: You assign the User Administrator role to User1. Does this meet the goal?

Yes
No Correct Answer

Community Insight

The question tests the distinction between general identity management and security posture management, with the common trap being the assumption that User Administrators have full access to all security-related tasks.

This question evaluates the specific permissions required to update Identity Secure Score improvement actions within a Microsoft 365 E5 environment. It establishes that the User Administrator role is insufficient for this task, requiring roles like Security Administrator or SharePoint Administrator instead.

Most candidates incorrectly select 'Yes', assuming that because the User Administrator manages identities, they also manage security scores. This overlooks the principle of least privilege and the specific delegation model for security tasks.

Community Discussion (20 comments)

ppardav 👍 1 Selected: A

https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/delegate-by-task#monitoring-and-health---recommendations-least-privileged-roles

Goyk 👍 1

when you read the contents of the link you share, it shows that the correct answer is B.

f5599e1 👍 1 Selected: B

The User Administrator role can: Create and manage users Reset passwords Manage some user properties However, it cannot manage Identity Secure Score improvement actions.

mamadou00225 👍 3 Selected: A

User Admin role meet the goal, these roles can update the secure score : SharePoint Administrator Helpdesk Administrator User Administrator Security Reader Security Operator Global Reader

GIFO00 👍 1 Selected: B

Option B is NO You need to UPDATE, Exchange Administrator is used as read only mode

Blabla532 👍 3 Selected: B

The User Administrator role only provides read-only access to Identity Secure Score improvement actions, meaning it cannot update their status. To update the status, a user must be assigned roles such as Security Administrator, Exchange Administrator, or SharePoint Administrator https://learn.microsoft.com/en-us/defender-xdr/microsoft-secure-score

mks_academy 👍 4 Selected: A

A is correct. https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/delegate-by-task#monitoring-and-health---recommendations-least-privileged-roles

f8c6a5b 👍 3 Selected: A

A is correct: Helpdesk Administrator User Administrator Security Reader Security Operator Global Reader

mariava2025 👍 4 Selected: A

The answer is here: https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/delegate-by-task#monitoring-and-health---recommendations-least-privileged-roles Update Identity Secure Score improvement action: - Least privileged role: SharePoint Administrator -Additional roles: Helpdesk Administrator User Administrator Security Reader Security Operator *Global Reader ----- Exchange Administrator just allow to: -READ Identity Secure Score improvement action -Update recommendations

Shad_700 👍 3 Selected: A

read the table in this articale : https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/delegate-by-task#monitoring-and-health---recommendations-least-privileged-roles

9d9e207 👍 1 Selected: B

the documentation at: https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/delegate-by-task#monitoring-and-health---recommendations-least-privileged-roles Is incorrect I believe - it has the update and read secure score improvement actions mixed up. I've submitted a pull request on the documentation to have it fixed.. I am fairly certain that the minimum role for update is sharepoint, while Sharepoint Administrator, Exchange Administrator and Security Administrator can update the actions

enigmaizhere 👍 3 Selected: A

The question says " update the status of Identity Secure Score improvement actions," & as per the link, we need a minimum "SharePoint Administrator". If u follow the reference link "https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/delegate-by-task#monitoring-and-health---recommendations-least-privileged-roles", u will see that "Update Identity Secure Score improvement action" needs any of the following roles : Helpdesk Administrator User Administrator Security Reader Security Operator Global Reader It does mention "User Administrator". Hence, I selected A as the answer.

Labelfree 👍 2 Selected: B

Seems counterintuitive that Exchange Admin is included, and User Admin is not, but False is correct here.

AlexBrazil 👍 1 Selected: B

https://learn.microsoft.com/en-us/entra/identity/monitoring-health/concept-identity-secure-score#read-and-write-roles With read and write access, you can make changes and directly interact with identity secure score: - Security Administrator - Exchange Administrator - SharePoint Administrator

a6792d4 👍 4

Read and write roles With read and write access, you can make changes and directly interact with identity secure score. Security Administrator Exchange Administrator SharePoint Administrator

EmnCours 👍 2 Selected: B

https://learn.microsoft.com/en-us/azure/active-directory/fundamentals/identity-secure-score#read-and-write-roles

dule27 👍 1 Selected: B

B. NO is the correct answer

m4rv1n 👍 4 Selected: B

With read and write access, you can make changes and directly interact with identity secure score. Global administrator Security administrator Exchange administrator SharePoint administrator

ShoaibPKDXB 👍 1 Selected: B

Correct B

boapaulo 👍 1

https://learn.microsoft.com/en-us/azure/active-directory/fundamentals/identity-secure-score#read-and-write-roles

Comments & Corrections

No comments yet — spotted an error or have a note? Share it below.

Expert Analysis

Why the Answer Is Correct

The correct answer is B (No). According to Microsoft's official documentation on delegating tasks by role, updating the status of Identity Secure Score improvement actions requires specific security-focused roles. The 'Least privileged role' for this task is the SharePoint Administrator, but other roles such as Security Administrator, Exchange Administrator, Helpdesk Administrator, Security Reader, Security Operator, and Global Reader are also permitted. The User Administrator role is explicitly not listed among those who can perform write operations on Identity Secure Score items.

Why the Other Options Are Wrong

Option A is incorrect because assigning the User Administrator role does not grant the necessary permissions. While User Administrators can create and manage users, their scope does not extend to modifying the state of security recommendations in the Identity Secure Score. Confusing user lifecycle management with security posture management is a frequent error.

Community Comment Notes

There is significant debate in the community. Several commenters cite the Microsoft Learn page 'delegate-by-task' to argue that User Administrator is included, pointing to lists that include it alongside Security Reader and Helpdesk Administrator. However, other commenters correctly identify that while some sources might list it broadly, the specific 'Update' action often requires higher-level security privileges like Security Administrator or SharePoint Administrator. As one commenter noted, 'Seems counterintuitive that Exchange Admin is included, and User Admin is not, but False is correct here.' The key is distinguishing between 'Read' access (which User Admin might have via Security Reader inclusion in some contexts) and 'Write/Update' access.

Official Reference

https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/delegate-by-task#monitoring-and-health---recommendations-least-privileged-roles

Exam Strategy

Always consult the specific 'Least Privileged Role' table for each task in the Microsoft Entra RBAC documentation. Do not assume that broad administrative roles like Global Admin or User Admin cover every sub-task; many security features require dedicated security roles.

Frequently Asked Questions

Which roles can update Identity Secure Score?

Roles include Security Administrator, SharePoint Administrator, Exchange Administrator, Helpdesk Administrator, Security Reader, Security Operator, and Global Reader.

Why is User Administrator not sufficient?

User Administrator focuses on user lifecycle management and does not have write access to security posture recommendations in the Identity Secure Score.

More SC-300 FAQ →

Related Analysis

Practice All SC-300 Questions

Access 80 questions with complete answers and detailed explanations.

View Full SC-300 Practice Test →

← Back to SC-300 Study Guide