Exam SC-400 topic 1 question 29 discussion

I really think reading the question in it's entirety in this this question they are assuming that trainable classifiers have already been enabled. The context is much different from this "You have a new Microsoft 365 tenant. You need to ensure that custom trainable classifiers can be created in the tenant. To which role should you be assigned to perform the configuration?" I go with A Compliance Admin

o Global admin: required to enable trainable classifier capability in the tenant o Compliance admin: required to use and train a trainable classifier

Should it not be Security Admin? Check this out: https://learn.microsoft.com/en-us/purview/classifier-get-started-with?view=o365-worldwide#prepare-for-a-custom-trainable-classifier 3. Sign in to the Microsoft Purview compliance portal with either Compliance admin or Security admin role access and navigate to Data classification > Classifiers. 4. Choose the Trainable classifiers tab. 5. Choose Create trainable classifier.

A bit tricky but as they ask for least privileges I'll go for Compliance administrator. You have to store the seed content at SharePoint Online.

On exam 1/20/2022

ermissions To access classifiers in the UI: the Global admin needs to opt in for the tenant to create custom classifiers. Compliance Administrator role is required to train a classifier. You'll need accounts with these permissions to use classifiers in these scenarios: Retention label policy scenario: Record Management and Retention Management roles Sensitivity label policy scenario: Security Administrator, Compliance Administrator, Compliance Data Administrator Communication compliance policy scenario: Insider Risk Management Admin, Supervisory Review Administrator

A global admin is needed to opt-in so trainable classifiers can be created and then a Compliance admin can train them. This one of those ambiguous questions, but as they are asking about least privilege, I'd say they want you to choose Compliance admin. https://docs.microsoft.com/en-us/microsoft-365/compliance/classifier-get-started-with?view=o365-worldwide#permissions

the documentation refers to Sharepoint online folder there is no mention of public folder. Everybody note that for RBAC answer is always least privilege and Global Admin only required to opt-in for creation if first time doing trainable classifiers - as the question does not state this is the first time the tenant is creating a TC the compliance admin can create it.

compliance admin can definitely create a trainable classifier as can a security admin -says so in documentation - compliance admin is least privilege

Wrong, only a global administrator van create a treinable classifier. Compliance admin can only train It.