DSPM for AI Auditing Status Role Assignment

SC-401 By islever Editorial Last updated

Implement and manage Microsoft Purview Insider Risk Management

Short answer

D Add User1 to the View-Only Organization Management for Microsoft Exchange Online role group to verify auditing status via Exchange configuration settings.

Question

You have a Microsoft 365 E5 subscription that contains a user named User1.
You deploy Microsoft Purview Data Security Posture Management for AI (DSPM for AI).
You need to ensure that User1 can verify the auditing status of the subscription. The solution must follow the principle of least privilege.
To which role group should you add User1?
  1. Security Reader
  2. Insider Risk Management Analysts
  3. Insider Risk Management Investigators
  4. View-Only Organization Management for Microsoft Exchange Online Correct Answer

Key Takeaways

The common trap is assuming the general 'Security Reader' role suffices; however, DSPM for AI specifically requires Exchange-specific view-only permissions to read the auditing ingestion status.

This question tests the specific role permissions required to verify auditing status within Microsoft Purview Data Security Posture Management for AI (DSPM for AI). The correct assignment is View-Only Organization Management for Microsoft Exchange Online, as it grants access to the Unified Audit Log configuration settings.

Common mistake: Most candidates incorrectly select Security Reader because it provides broad read-only access to security reports, failing to recognize that DSPM for AI's auditing check relies on Exchange Online configuration visibility.

Expert Analysis

Why the Answer Is Correct

The correct answer is D. To verify the auditing status in Microsoft Purview DSPM for AI, a user must be able to read the UnifiedAuditLogIngestionEnabled setting. This setting is part of the Exchange Online configuration. The 'View-Only Organization Management for Microsoft Exchange Online' role group includes the 'View-Only Configuration' role, which allows users to run commands like Get-AdminAuditLogConfig to view this status without granting write access.

Why the Other Options Are Wrong

Security Reader (A) provides read-only access to security and compliance data but explicitly excludes the ability to view the 'Activate Audit' status in DSPM for AI, as noted in Microsoft's official permission tables. Insider Risk Management Analysts (B) and Investigators (C) have broader investigative capabilities and are not minimal or appropriate for this specific read-only verification task.

Community Comment Notes

Community consensus was split, but those referencing the official DSPM for AI permissions table correctly identified that Security Reader cannot see the auditing status. As one commenter noted, "Microsoft’s DSPM for AI permissions table says view-only roles such as Security Reader can view completion status... but not the status of 'Activate Audit'." Another highlighted that "View-Only Organization Management only covers the auditing part in Exchange Online," confirming the necessity of the Exchange-specific role for this specific check.

Official Reference

https://learn.microsoft.com/en-us/purview/audit-log-enable-disable

This link opens the official vendor documentation in a new tab.

Exam Strategy

When dealing with Microsoft Purview features, always check if the feature relies on underlying services like Exchange Online or SharePoint. If a 'read status' task involves audit logs, verify if the role needs Exchange-specific configuration permissions rather than just general security reading rights.

Frequently Asked Questions

Why can't Security Reader view DSPM auditing status?

Security Reader lacks the specific permission to read the UnifiedAuditLogIngestionEnabled setting in Exchange Online, which DSPM for AI uses to report auditing status.

Is View-Only Organization Management too privileged?

No, it is the least privilege option for this task because it only grants read-only access to Exchange Online configuration, which is necessary to check the audit log status.

More SC-401 FAQ →

Discussion 10 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 10

  1. 454252dfr 👍 14 Answered A
    The correct role group to add User1 to is A. Security Reader. The Security Reader role group provides read-only access to security-related reports and data in Microsoft 365, including auditing logs. This role aligns with the principle of least privilege, as it allows User1 to verify the auditing status without granting them permissions to modify settings or access sensitive content beyond what is necessary for their task. The other options grant broader permissions or are specific to different areas of compliance that don't directly relate to verifying the general auditing status of the subscription.
  2. gabbinu 👍 11 Answered D
    https://learn.microsoft.com/en-us/purview/audit-log-enable-disable To verify tenant auditing you just need to read the setting UnifiedAuditLogIngestionEnabled (e.g., with Get-AdminAuditLogConfig). The View-Only Organization Management role group includes the View-Only Configuration role, which is sufficient to read that auditing status.
  3. AlejandroCaSa 👍 6
    wrong. View-Only Organization Management only covers the auditing part in Exchange Online, not necessarily the full visibility of the auditing status in Microsoft Purview or DSPM for AI.
  4. Jideakin 👍 4 Answered A
    Correct Answer is A. The specific role (or permission) required to view auditing status is the "View-Only Manage Alerts" and Security Reader is the only Role Group of all the listed that includes it. https://learn.microsoft.com/en-us/defender-office-365/scc-permissions View-Only Organization Management: Members can view the properties of any object in the Exchange Online organization; not tenant setting like audit status. https://learn.microsoft.com/en-us/exchange/permissions-exo/permissions-exo
  5. SSL2 👍 2 Answered D
    D. View-Only Organization Management for Microsoft Exchange Online Microsoft’s DSPM for AI permissions table says view-only roles such as Security Reader can view completion status for getting started steps, but not the status of “Activate Audit.” To view that auditing status, Microsoft lists Microsoft Exchange View-Only Organization Management as an additional required role group https://learn.microsoft.com/en-us/purview/ai-microsoft-purview-permissions
Show 5 more comments
  1. Eltooth 👍 2 Answered A
    A is correct answer : Security Reader
  2. NeerajSap 👍 1 Answered A
    In Microsoft Purview DSPM for AI, verifying the auditing status is a read-only task. Following the principle of least privilege, User1 should be assigned a role that allows viewing security and compliance information without granting investigation or administrative capabilities. The Security Reader role group provides read-only access to security and compliance features, including viewing auditing-related status and configuration information
  3. Scrambles 👍 1 Answered D
    Microsoft’s DSPM for AI permissions table has a row for viewing the completion status of the getting-started steps. The Security Reader group (view-only) is excluded from seeing the status of Activate Audit.
  4. kollyp2000 👍 1 Answered D
    Security Reader can see DSPM for AI, but it can’t see whether auditing is on. Source: Permissions for Data Security Posture Management for AI (classic): Permissions by activities
  5. Jideakin 👍 1
    Correction - The required role is "audit logs" and "View-Only Organization Management" is the only one that has it. Correct Answer is D

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Using Sensitivity Labels to Restrict Microsoft 365 Copilot Access

S-grade

Microsoft Purview Retention Policy Conflict Resolution

S-grade

Maximum Primary Elements in Microsoft Purview EDM Classifier

S-grade

Encrypting Emails with Azure Storage Keys via DLP

S-grade

← Back to SC-401 Study Guide