Identity Secure Score Update Permissions in Microsoft Entra ID

SC-300 By islever Editorial Last updated

Plan and implement privileged access

Short answer

B Assigning the User Administrator role does not meet the goal because it lacks permission to update Identity Secure Score improvement actions.

Question

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
You have a Microsoft 365 E5 subscription.
You create a user named User1.
You need to ensure that User1 can update the status of Identity Secure Score improvement actions.
Solution: You assign the User Administrator role to User1.
Does this meet the goal?
  1. Yes
  2. No Correct Answer

Key Takeaways

The question tests the distinction between general identity management and security posture management, with the common trap being the assumption that User Administrators have full access to all security-related tasks.

This question evaluates the specific permissions required to update Identity Secure Score improvement actions within a Microsoft 365 E5 environment. It establishes that the User Administrator role is insufficient for this task, requiring roles like Security Administrator or SharePoint Administrator instead.

Common mistake: Most candidates incorrectly select 'Yes', assuming that because the User Administrator manages identities, they also manage security scores. This overlooks the principle of least privilege and the specific delegation model for security tasks.

Expert Analysis

Why the Answer Is Correct

The correct answer is B (No). According to Microsoft's official documentation on delegating tasks by role, updating the status of Identity Secure Score improvement actions requires specific security-focused roles. The 'Least privileged role' for this task is the SharePoint Administrator, but other roles such as Security Administrator, Exchange Administrator, Helpdesk Administrator, Security Reader, Security Operator, and Global Reader are also permitted. The User Administrator role is explicitly not listed among those who can perform write operations on Identity Secure Score items.

Why the Other Options Are Wrong

Option A is incorrect because assigning the User Administrator role does not grant the necessary permissions. While User Administrators can create and manage users, their scope does not extend to modifying the state of security recommendations in the Identity Secure Score. Confusing user lifecycle management with security posture management is a frequent error.

Community Comment Notes

There is significant debate in the community. Several commenters cite the Microsoft Learn page 'delegate-by-task' to argue that User Administrator is included, pointing to lists that include it alongside Security Reader and Helpdesk Administrator. However, other commenters correctly identify that while some sources might list it broadly, the specific 'Update' action often requires higher-level security privileges like Security Administrator or SharePoint Administrator. As one commenter noted, 'Seems counterintuitive that Exchange Admin is included, and User Admin is not, but False is correct here.' The key is distinguishing between 'Read' access (which User Admin might have via Security Reader inclusion in some contexts) and 'Write/Update' access.

Official Reference

https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/delegate-by-task#monitoring-and-health---recommendations-least-privileged-roles

This link opens the official vendor documentation in a new tab.

Exam Strategy

Always consult the specific 'Least Privileged Role' table for each task in the Microsoft Entra RBAC documentation. Do not assume that broad administrative roles like Global Admin or User Admin cover every sub-task; many security features require dedicated security roles.

Frequently Asked Questions

Which roles can update Identity Secure Score?

Roles include Security Administrator, SharePoint Administrator, Exchange Administrator, Helpdesk Administrator, Security Reader, Security Operator, and Global Reader.

Why is User Administrator not sufficient?

User Administrator focuses on user lifecycle management and does not have write access to security posture recommendations in the Identity Secure Score.

More SC-300 FAQ →

Discussion 19 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 19

  1. mariava2025 👍 4 Answered A
    The answer is here: https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/delegate-by-task#monitoring-and-health---recommendations-least-privileged-roles Update Identity Secure Score improvement action: - Least privileged role: SharePoint Administrator -Additional roles: Helpdesk Administrator User Administrator Security Reader Security Operator *Global Reader ----- Exchange Administrator just allow to: -READ Identity Secure Score improvement action -Update recommendations
  2. a6792d4 👍 4
    Read and write roles With read and write access, you can make changes and directly interact with identity secure score. Security Administrator Exchange Administrator SharePoint Administrator
  3. m4rv1n 👍 4 Answered B
    With read and write access, you can make changes and directly interact with identity secure score. Global administrator Security administrator Exchange administrator SharePoint administrator
  4. mks_academy 👍 4 Answered A
    A is correct. https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/delegate-by-task#monitoring-and-health---recommendations-least-privileged-roles
  5. enigmaizhere 👍 3 Answered A
    The question says " update the status of Identity Secure Score improvement actions," & as per the link, we need a minimum "SharePoint Administrator". If u follow the reference link "https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/delegate-by-task#monitoring-and-health---recommendations-least-privileged-roles", u will see that "Update Identity Secure Score improvement action" needs any of the following roles : Helpdesk Administrator User Administrator Security Reader Security Operator Global Reader It does mention "User Administrator". Hence, I selected A as the answer.
Show 14 more comments
  1. Blabla532 👍 3 Answered B
    The User Administrator role only provides read-only access to Identity Secure Score improvement actions, meaning it cannot update their status. To update the status, a user must be assigned roles such as Security Administrator, Exchange Administrator, or SharePoint Administrator https://learn.microsoft.com/en-us/defender-xdr/microsoft-secure-score
  2. Shad_700 👍 3 Answered A
    read the table in this articale : https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/delegate-by-task#monitoring-and-health---recommendations-least-privileged-roles
  3. mamadou00225 👍 3 Answered A
    User Admin role meet the goal, these roles can update the secure score : SharePoint Administrator Helpdesk Administrator User Administrator Security Reader Security Operator Global Reader
  4. f8c6a5b 👍 3 Answered A
    A is correct: Helpdesk Administrator User Administrator Security Reader Security Operator Global Reader
  5. EmnCours 👍 2 Answered B
    https://learn.microsoft.com/en-us/azure/active-directory/fundamentals/identity-secure-score#read-and-write-roles
  6. Labelfree 👍 2 Answered B
    Seems counterintuitive that Exchange Admin is included, and User Admin is not, but False is correct here.
  7. 9d9e207 👍 1 Answered B
    the documentation at: https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/delegate-by-task#monitoring-and-health---recommendations-least-privileged-roles Is incorrect I believe - it has the update and read secure score improvement actions mixed up. I've submitted a pull request on the documentation to have it fixed.. I am fairly certain that the minimum role for update is sharepoint, while Sharepoint Administrator, Exchange Administrator and Security Administrator can update the actions
  8. AlexBrazil 👍 1 Answered B
    https://learn.microsoft.com/en-us/entra/identity/monitoring-health/concept-identity-secure-score#read-and-write-roles With read and write access, you can make changes and directly interact with identity secure score: - Security Administrator - Exchange Administrator - SharePoint Administrator
  9. f5599e1 👍 1 Answered B
    The User Administrator role can: Create and manage users Reset passwords Manage some user properties However, it cannot manage Identity Secure Score improvement actions.
  10. ppardav 👍 1 Answered A
    https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/delegate-by-task#monitoring-and-health---recommendations-least-privileged-roles
  11. Goyk 👍 1
    when you read the contents of the link you share, it shows that the correct answer is B.
  12. GIFO00 👍 1 Answered B
    Option B is NO You need to UPDATE, Exchange Administrator is used as read only mode
  13. dule27 👍 1 Answered B
    B. NO is the correct answer
  14. ShoaibPKDXB 👍 1 Answered B
    Correct B

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

How Long Are Microsoft Entra Risky User Activity Logs Retained?

S-grade

Azure User-Assigned Managed Identity Regional Scope

S-grade

Which role for the Permissions Management service principal?

S-grade

Prerequisite for Microsoft Defender for Cloud Apps Session Policy

S-grade

Practice All SC-300 Questions

Access 80 questions with complete answers and detailed explanations.

View Full SC-300 Practice Test →

← Back to SC-300 Study Guide