Exam SC-200 topic 7 question 11 discussion

correct answer

To create and delete a Microsoft Sentinel workbook, the user needs either the Microsoft Sentinel Contributor role or a lesser Microsoft Sentinel role, together with the Workbook Contributor Azure Monitor role.

https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles/monitor#workbook-contributor

To manage TEMPLATES (not only workbook), you need the Workbook Contributor Role, not the Sentinel Contributor Role which help managing workbooks (not templates)

Actions Description Microsoft.Insights/workbooks/write Create or update a workbook Microsoft.Insights/workbooks/delete Delete a workbook Microsoft.Insights/workbooks/read Read a workbook Microsoft.Insights/workbooks/revisions/read Get the workbook revisions Microsoft.Insights/workbooktemplates/write Create or update a workbook template Microsoft.Insights/workbooktemplates/delete Delete a workbook template Microsoft.Insights/workbooktemplates/read Read a workbook template https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles/monitor#workbook-contributor

Correct answer

B---->ok

Answer: B. Workbook Contributor Explanation: Workbook Contributor role grants the required permissions to deploy and customize workbook templates in Microsoft Sentinel. It provides the ability to create and modify workbooks without granting broader permissions that are not needed for this task. The other roles provide broader access or different functionalities that are not necessary for just working with workbook templates: A. Microsoft Sentinel Contributor grants broader permissions across Microsoft Sentinel but is not required solely for workbook templates. C. Microsoft Sentinel Automation Contributor is focused on automating tasks and is unrelated to workbooks. D. Contributor grants full access to manage all resources in the resource group, which is more access than needed. Therefore, Workbook Contributor is the best choice for this scenario.