Exam MS-101 topic 2 question 28 discussion

Answer A. Came on exam 09-05-2022

According to https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/assign-portal-access?view=o365-worldwide i think A is correct. If you have already assigned basic permissions, you may switch to RBAC anytime. Consider the following before making the switch: Users with full access (users that are assigned the Global Administrator or Security Administrator directory role in Azure AD), are automatically assigned the default Defender for Endpoint administrator role, which also has full access. Additional Azure AD user groups can be assigned to the Defender for Endpoint administrator role after switching to RBAC. Only users assigned to the Defender for Endpoint administrator role can manage permissions using RBAC. Users that have read-only access (Security Readers) will lose access to the portal until they are assigned a role. Note that only Azure AD user groups can be assigned a role under RBAC.

The Answer is A. https://docs.microsoft.com/en-us/azure/active-directory/roles/permissions-reference#security-operator

A "Turning on role-based access control will cause users with read-only permissions (for example, users assigned to Azure AD Security reader role) to lose access until they are assigned to a role." https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/rbac?view=o365-worldwide

I'm thinking Security reader would satisfy the requirement to view incidents - https://docs.microsoft.com/en-us/azure/active-directory/roles/permissions-reference#security-reader

A. Security Administrator