Exam MS-100 topic 3 question 9 discussion

The answer is correct and the ref should be https://docs.microsoft.com/en-gb/microsoft-365/security/office-365-security/permissions-in-the-security-and-compliance-center#mapping-of-role-groups-to-assigned-roles Records Management Role Group has the role Retention Management and is less priviliged than compliance admin so the correct answer

Answer: C Explanation Members of your compliance team who will create retention labels need permissions to the Security & Compliance Center. By default, your tenant admin has access to this location and can give compliance officers and other people access to the Security & Compliance Center, without giving them all of the permissions of a tenant admin. To do this, we recommend that you go to the Permissions page of the Security & Compliance Center, edit the Compliance Administrator role group, and add members to that role group. Reference: https://docs.microsoft.com/en-us/microsoft-365/compliance/labels#permissions

The "Records Management" role allows users to create, configure, and manage retention labels and policies.

https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/permissions-in-the-security-and-compliance-center?view=o365-worldwide#role-groups-in-the-defender-and-compliance-portals Members can configure all aspects of records management, including retention labels and disposition reviews.

States Which Role Group, there is no Records Management Role group, can create a new Role group and just add this Role but that's not what is asked so the given answer appears correct to me

Correct answer

The Answer is correct: C https://learn.microsoft.com/en-us/microsoft-365/compliance/get-started-with-data-lifecycle-management?view=o365-worldwide#permissions-for-retention-policies-and-retention-labels

Records Management Members can configure all aspects of records management, including retention labels and disposition reviews. https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/permissions-in-the-security-and-compliance-center?view=o365-worldwide

https://docs.microsoft.com/en-us/microsoft-365/compliance/get-started-with-data-lifecycle-management?view=o365-worldwide - Compliance Administrator admin role group (Ok) - new role group and add the Retention Management role to this group (not Ok)

least privilege is Records Management, so the answer is B.

Do your research, Answer is C! There is no specific ‘records manager’ role in Microsoft 365. The closest in terms of functionality is the Compliance admin role that includes several several sub-roles including ‘RecordManagement’, ‘Disposition Management’ and ‘Retention Management’. Answer C, you cannot assign a records management role to a user so there :)

Records Management is the ones with less privilege "Members can configure all aspects of records management, including retention labels and disposition reviews." ref: https://docs.microsoft.com/en-us/microsoft-365/security/office-365-security/permissions-in-the-security-and-compliance-center?view=o365-worldwide

Least privilege so should be B

I tested this and a user assigned to Records Management role has the necessary permissions to create and publish retention labels. So answer is B, following the least privilege principle.

o grant permissions for this limited administration, we recommend that you add users to the Compliance Administrator admin role group. Alternatively to using this default role, you can create a new role group and add the Retention Management role to this group. For a read-only role, use View-Only Retention Management. Source: https://docs.microsoft.com/en-us/microsoft-365/compliance/get-started-with-retention?view=o365-worldwide#permissions-required-to-create-and-manage-retention-policies-and-retention-labels

The solution must use the principle of least privilege, B is the answer.

records management: Additionally, retention labels support records management for email and documents across Microsoft 365 apps and services. You can use a retention label to mark items as a record. https://docs.microsoft.com/en-us/microsoft-365/compliance/retention?view=o365-worldwide#permissions