Exam MS-500 topic 2 question 26 discussion

Azure Sentinel Contributor + Logic App Contributor is correct

the given answer D & E are correct Azure Sentinel Contributor Create and edit workbooks, analytic rules, and other Azure Sentinel resources Manage incidents (dismiss, assign, etc.) view data, incidents, workbooks, and other Azure Sentinel resources Logic App Contributor Create and run playbooks

The highlighted answers are wrong. correct answer is B & E Azure sentinel contributor does not satisfy the requirement in the question " Least privilege "

To achieve the tasks of creating and running playbooks, as well as managing incidents in Azure Sentinel while following the principle of least privilege, you should assign the following built-in RBAC roles: A. Automation Operator C. Automation Runbook Operator The Automation Operator role provides the necessary permissions to create and run playbooks in Azure Sentinel. This role allows users to design and execute automation logic using playbooks without granting excessive privileges. The Automation Runbook Operator role specifically grants permissions to run automation runbooks. While playbooks in Azure Sentinel are implemented using Logic Apps, the Automation Runbook Operator role is designed for Azure Automation and can be used to execute runbooks associated with playbooks. Assigning only the Automation Operator and Automation Runbook Operator roles ensures that users have the necessary permissions to create and run playbooks while minimizing their access to other sensitive Azure Sentinel resources.

B E Azure Sentinel Responder: manage incidents Logic App Contributor: create and run playbooks Azure Sentinel Contributor is correct too but because of principle of least privilege, this is incorrect. Reference: https://learn.microsoft.com/en-us/azure/sentinel/roles#microsoft-sentinel-roles-permissions-and-allowed-actions

Correction

BE responder can manage incidents

Microsoft Sentinel Reader can view data, incidents, workbooks, and other Microsoft Sentinel resources. Microsoft Sentinel Responder can, in addition to the above, manage incidents (assign, dismiss, etc.). Option B You can use the Microsoft Sentinel Playbook Operator role to assign explicit, limited permission for running playbooks, and the Logic App Contributor role to create and edit playbooks. Option E

Considering Least Privilege, the roles should be B (Microsoft Sentinel Responder) to Manage Incidents and E (Logic App Contributor) to create and run playbooks. https://learn.microsoft.com/en-us/azure/sentinel/roles#roles-and-allowed-actions

Valid on exam as of 9/21/2022

Badly worded… Microsoft Sentinel Contributor role lets you attach a playbook to an analytics rule. Microsoft Sentinel Responder role lets you run an already attached playbook. Logic App contributor is a given, but there’s not enough info in this question - you can’t make assumptions. However, LAC role can create as many playbooks as they want, unless they are MSC they can’t attach any… I’d go DE to be safe but BE does fall within the parameters of the question.

See naren49 and the table here: https://docs.microsoft.com/en-us/azure/sentinel/roles#microsoft-sentinel-roles-and-allowed-actions

You need to have BOTH Azure Sentinel Contributor and Logic App Contributor in order to fulfill the requirement of being able to "Create and Run Playbooks" See Microsoft's chart specifically showing this, here: https://docs.microsoft.com/en-us/azure/sentinel/roles#microsoft-sentinel-roles-and-allowed-actions

D & E are correct!

Azure Sentinel Contributor + Logic App Contributor is correct

You can use the Logic App Contributor role to assign explicit permission for using playbooks. Microsoft Sentinel Responder can, in addition to the above, manage incidents (assign, dismiss, etc.) https://docs.microsoft.com/en-us/azure/sentinel/roles#roles-and-allowed-actions

D. Azure Sentinel contributor E. Logic App contributor https://docs.microsoft.com/en-us/azure/sentinel/roles Refer to the table Microsoft Sentinel Contributor + Logic App Contributor Create and run playbooks Manage incidents (dismiss, assign, etc.) Microsoft Sentinel roles and allowed actions The following table summarizes the Microsoft Sentinel roles and their allowed actions in Microsoft Sentinel.