DSPM for AI Auditing Status Role Assignment
You have a Microsoft 365 E5 subscription that contains a user named User1. You deploy Microsoft Purview Data Security Posture Management for AI (DSPM for AI). You need to ensure that User1 can verify the auditing status of the subscription. The solution must follow the principle of least privilege. To which role group should you add User1?
Community Insight
The common trap is assuming the general 'Security Reader' role suffices; however, DSPM for AI specifically requires Exchange-specific view-only permissions to read the auditing ingestion status.
This question tests the specific role permissions required to verify auditing status within Microsoft Purview Data Security Posture Management for AI (DSPM for AI). The correct assignment is View-Only Organization Management for Microsoft Exchange Online, as it grants access to the Unified Audit Log configuration settings.
Most candidates incorrectly select Security Reader because it provides broad read-only access to security reports, failing to recognize that DSPM for AI's auditing check relies on Exchange Online configuration visibility.
Community Discussion (10 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
The correct answer is D. To verify the auditing status in Microsoft Purview DSPM for AI, a user must be able to read the UnifiedAuditLogIngestionEnabled setting. This setting is part of the Exchange Online configuration. The 'View-Only Organization Management for Microsoft Exchange Online' role group includes the 'View-Only Configuration' role, which allows users to run commands like Get-AdminAuditLogConfig to view this status without granting write access.Why the Other Options Are Wrong
Security Reader (A) provides read-only access to security and compliance data but explicitly excludes the ability to view the 'Activate Audit' status in DSPM for AI, as noted in Microsoft's official permission tables. Insider Risk Management Analysts (B) and Investigators (C) have broader investigative capabilities and are not minimal or appropriate for this specific read-only verification task.Community Comment Notes
Community consensus was split, but those referencing the official DSPM for AI permissions table correctly identified that Security Reader cannot see the auditing status. As one commenter noted, "Microsoft’s DSPM for AI permissions table says view-only roles such as Security Reader can view completion status... but not the status of 'Activate Audit'." Another highlighted that "View-Only Organization Management only covers the auditing part in Exchange Online," confirming the necessity of the Exchange-specific role for this specific check.Official Reference
Exam Strategy
When dealing with Microsoft Purview features, always check if the feature relies on underlying services like Exchange Online or SharePoint. If a 'read status' task involves audit logs, verify if the role needs Exchange-specific configuration permissions rather than just general security reading rights.
Frequently Asked Questions
Why can't Security Reader view DSPM auditing status?
Security Reader lacks the specific permission to read the UnifiedAuditLogIngestionEnabled setting in Exchange Online, which DSPM for AI uses to report auditing status.
Is View-Only Organization Management too privileged?
No, it is the least privilege option for this task because it only grants read-only access to Exchange Online configuration, which is necessary to check the audit log status.