Exam SC-200 topic 4 question 5 discussion

Regarding "endpoint security policies", the role should be Security Admin, as per this link: https://learn.microsoft.com/en-us/defender-endpoint/mde-security-settings-management "The Endpoint Security Policies page in Microsoft Defender XDR is available only for users with the security administrator role in Microsoft Defender XDR. Any other user role, such as Security Reader, cannot access the portal. When a user has the required permissions to view policies in the Microsoft Defender portal, the data is presented based on Intune permissions. If the user is in scope for Intune role-based access control, it applies to the list of policies presented in the Microsoft Defender portal. We recommend granting security administrators with the Intune built-in role, "Endpoint Security Manager" to effectively align the level of permissions between Intune and Microsoft Defender XDR."

Security Administrator is correct answer Operator has less privileges - View, investigate, and respond to active threats to your Microsoft 365 users, devices, and content. For more information, see Security Operator. https://learn.microsoft.com/en-us/defender-office-365/mdo-portal-permissions

Remember that the Security Administrator role is focused on configuration and settings management. As soon as you see managing rules or policies in the question, that answer should be Security Administrator. The Security Operator role focuses on the day-to-day operations like viewing and investigating alerts (think of L1 SOC analyst)

Security Administrator (Option A): This role allows full management of security-related features across Microsoft 365, including the ability to manage security settings, policies, alerts, and more. However, this role grants broad permissions that go beyond just managing Microsoft Defender XDR custom detection rules and Endpoint security policies. Security Operator (Option B): This role focuses more on handling alerts, investigating incidents, and responding to threats. It provides access to review and remediate alerts but doesn't allow managing custom detection rules or security policies.

Security Admin because the operator can't change or modify anything only read

One of the following roles is required for Defender for Office 365 Manage alerts Security admin if its O365 then its Secuirty Admin

I think it should be B:Security Operator

B. Security Operator