Identity Secure Score Permissions in Microsoft Entra
Manage risk by using Microsoft Entra ID Protection
Answer
Correct answer: B — The Security Operator role does not have permission to update Identity Secure Score improvement actions.
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have a Microsoft 365 E5 subscription. You create a user named User1. You need to ensure that User1 can update the status of Identity Secure Score improvement actions. Solution: You assign the Security Operator role to User1. Does this meet the goal?
Community Insight
The common trap is confusing 'read' monitoring roles with 'write' administrative roles; Security Operator can view scores but cannot update action status.
This question tests whether the Security Operator role grants write access to Identity Secure Score improvement actions. The correct answer is No, as this role only provides read-only visibility.
Learners often select Yes because they assume 'Security Operator' implies full security management capabilities, including remediation actions, which is incorrect for this specific task.
Community Discussion (24 comments)
Goyk
👍 1
Selected: A
The Security Operator has write access as said in: https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/delegate-by-task#monitoring-and-health---recommendations-least-privileged-roles
Provost
👍 1
Selected: B
Security Operator can view Identity Secure Score improvement actions, but can't update their status. Roles that can view but not edit: Security Reader, Security Operator, Global Reader, Helpdesk Administrator, Service Support Administrator, User Administrator. Roles that can update the status: Global Administrator Security Administrator Exchange Administrator SharePoint Administrator
Provost
👍 1
Selected: A
The trick is that Security Operator cannot update Identity Secure Score improvement actions. Microsoft's current role documentation specifically lists: - Update Identity Secure Score improvement action - Least privileged: SharePoint Administrator - Additional roles: Helpdesk Administrator, User Administrator, Security Reader, Security Operator, Global Reader Microsoft Learn However, there's an important nuance: those additional roles are not necessarily write permissions for every Secure Score operation. Microsoft's current Secure Score documentation says Security Operator has read-only access and cannot edit the status/notes of a recommended action.
Provost
👍 1
- Selected answer is B.Security Operator can view Identity Secure Score improvement actions, but can't update their status. Roles that can view but not edit: Security Reader, Security Operator, Global Reader, Helpdesk Administrator, Service Support Administrator, User Administrator. Roles that can update the status: Global Administrator Security Administrator Exchange Administrator SharePoint Administrator
KindFlame
👍 1
Selected: A
A. Yes The table shows that Security Operator role can perform Update [Identity Secure Score] recommendation tasks. https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/delegate-by-task#monitoring-and-health---recommendations-least-privileged-roles
951d1f5
👍 1
Selected: A
Actualizar (Update Identity Secure Score improvement action): SharePoint Administrator (rol mínimo) Helpdesk Administrator User Administrator Security Reader Security Operator Global Reader
sheilawu
👍 1
Selected: A
Who can Update Identity Secure Score improvement action Helpdesk Administrator User Administrator Security Reader Security Operator Global Reader https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/delegate-by-task#monitoring-and-health---recommendations-least-privileged-roles
Blabla532
👍 1
Selected: A
Security Operator meets the goal: It is explicitly listed in the "Additional roles" column for updating these actions. https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/delegate-by-task#monitoring-and-health---recommendations-least-privileged-roles
VidJay
👍 1
Selected: A
Security Operator can update the Identity secure score, its one of the addtional non-global admin role that can perform the task https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/delegate-by-task
node627
👍 1
Selected: A
Answer is A Microsoft has been gradually merging Secure Score, Identity Secure Score, and Recommendations into a unified experience. Therefore, the Least privileged role AND the additional roles listed here can update the Identity Security Score. If you’re using the new Recommendations experience, this is the correct and current behavior. If you’re using the old Secure Score interface, the older restrictions may still apply.
wamanuzu
👍 2
Selected: A
The statement is clear: SharePoint Administrator Helpdesk Administrator User Administrator Security Reader Security Operator Global Reader Can update. Because it was not asked for the least privileged permission, is correct. Source: https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/delegate-by-task#monitoring-and-health---recommendations-least-privileged-roles
Payday123
👍 1
Selected: A
"Update Identity Secure Score improvement action: SharePoint Administrator Helpdesk Administrator User Administrator Security Reader Security Operator Global Reader" Even Security Reader can update that! https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/delegate-by-task#monitoring-and-health---recommendations-least-privileged-roles
42fe98b
👍 1
Selected: A
https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/delegate-by-task#monitoring-and-health---recommendations-least-privileged-roles
Hamouda1
👍 1
Selected: B
correct
d21d6ba
👍 4
Selected: A
I agree, it should be A. In the link it states in the UPDATE secure score improvement that Security Operator is one of the additional roles for it
jitla7
👍 4
Selected: A
Answer should be A = Yes As per this link the following roles can do the job Update Identity Secure Score improvement action SharePoint Administrator Helpdesk Administrator User Administrator Security Reader Security Operator Global Reader https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/delegate-by-task#monitoring-and-health---recommendations-least-privileged-roles
Shad_700
👍 1
Selected: A
https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/delegate-by-task#monitoring-and-health---recommendations-least-privileged-roles
Neshiri
👍 3
Selected: A
Update Identity Secure Score improvement action SharePoint Administrator Helpdesk Administrator User Administrator Security Reader Security Operator Global Reader
jitla7
👍 1
Selected: A
As per this link the following roles can Update Identity Secure Score Improvement Actions SharePoint Administrator (Least Privilege) Helpdesk Administrator User Administrator Security Reader Security Operator Global Reader Answer is A = Security Operator
6b71b61
👍 2
Selected: A
Answer is correct (technically) the lease priviledged role is SharePoint Administrator. Other roles are Helpdesk Admin, User Admin, Security Reader, Security Operator, Global Reader https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/delegate-by-task#monitoring-and-health---recommendations-least-privileged-roles
enigmaizhere
👍 2
Selected: A
The question says " update the status of Identity Secure Score improvement actions," & as per the link, we need a minimum "SharePoint Administrator". If u follow the reference link "https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/delegate-by-task#monitoring-and-health---recommendations-least-privileged-roles", u will see that "Update Identity Secure Score improvement action" needs any of the following roles : Helpdesk Administrator User Administrator Security Reader Security Operator Global Reader It does mention "Security Operator". Hence, I selected A as the answer.
test123123
👍 3
Selected: B
Global administrator Security administrator Exchange administrator SharePoint administrator
sehlohomoletsane
👍 2
Selected: B
The answer is no
nils241
👍 17
Selected: B
B With read and write access, you can make changes and directly interact with identity secure score. Global administrator Security administrator Exchange administrator SharePoint administrator Security Operator has only read access, so he can not update anything https://learn.microsoft.com/en-us/azure/active-directory/fundamentals/identity-secure-score#who-can-use-the-identity-secure-score
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
The Security Operator role in Microsoft Entra ID is designed for monitoring and responding to identity risks, such as reviewing sign-in alerts or managing risk policies. However, it does not include permissions to modify Identity Secure Score improvement actions. To update the status of these actions (e.g., marking an improvement as complete), a user requires a role with write access to the underlying SharePoint sites where score data is stored, such as SharePoint Administrator or Global Administrator.Why the Other Options Are Wrong
Selecting 'Yes' is incorrect because the Security Operator role explicitly lacks the necessary write privileges for the Identity Secure Score service. While it allows viewing the score and recommendations, it cannot interact with the improvement actions to change their state. This distinction is critical for least-privilege implementation, as granting broader admin rights just for this task would violate security principles.Community Comment Notes
Many community members initially doubted the answer, citing older documentation that listed Security Operator as having update capabilities. As one commenter noted, "In the link it states... Security Operator is one of the additional roles for it," reflecting confusion from outdated sources. However, current official Microsoft documentation clarifies that Security Operator has read-only access to the score itself, while updating improvements requires roles like SharePoint Administrator. The consensus among those referencing the latest RBAC delegation tasks confirms that Security Operator cannot perform the update action.Official Reference
Exam Strategy
Always verify the specific permissions of built-in roles against the latest Microsoft documentation, especially for security-focused roles that evolve frequently. When asked about 'updating' or 'remediating' items, ensure the role has write access, not just read access.
Frequently Asked Questions
Why can't Security Operator update Identity Secure Score?
Security Operator has read-only access to the score. Updating actions requires write access to the SharePoint backend, held by roles like SharePoint Administrator.
Which role is required to update Identity Secure Score actions?
Roles with write access to the relevant resources are needed, such as SharePoint Administrator, Global Administrator, or Exchange Administrator.
Related Analysis
Practice All SC-300 Questions
Access 80 questions with complete answers and detailed explanations.
View Full SC-300 Practice Test →