Exam SC-400 topic 1 question 9 discussion

Correct answer is Global Admin: https://docs.microsoft.com/en-us/microsoft-365/compliance/classifier-get-started-with?view=o365-worldwide "the Global admin needs to opt in for the tenant to create custom classifiers. Compliance Administrator role is required to train a classifier"

Based on my label test. the correct answer is Compliance administrator

Global Admin has the highest level of permissions across Microsoft 365, but it is not automatically granted permissions inside specialised portals like Microsoft Purview (compliance portal) for sensitive tasks such as data classification, DLP, or trainable classifiers.

D. Compliance administrator Explanation: Custom trainable classifiers are part of Microsoft Purview compliance solutions. The Compliance administrator role has the necessary permissions to configure and manage compliance settings, including trainable classifiers, data loss prevention policies, and more. While the Global administrator (C) also has broad permissions across the tenant, the Compliance administrator is more targeted to this specific compliance functionality.

To ensure that custom trainable classifiers can be created in a Microsoft 365 tenant, you need to be assigned the Compliance Administrator role. This role has the necessary permissions to manage compliance features, including the ability to create and manage trainable classifiers within Microsoft Purview's Information Protection and Data Loss Prevention (DLP) functionalities. Alternatively, the Security Administrator or Global Administrator roles may also have permissions to perform these actions, but Compliance Administrator is the most directly aligned role for this task.

D is correct, tested in a demo tenant

https://learn.microsoft.com/en-us/purview/trainable-classifiers-get-started-with?view=o365-worldwide#:~:text=either%20Compliance%20admin%20or%20Security%20admin requirements to create trainable classifiers are either CA or SA GA is not relevant

From the phrasing of the question it seems like it's asking what's required to opt in. Typical Microsoft trickery. You need to "ENSURE" that custom trainable classifiers "CAN BE CREATED" in the tenant. To ensure that the classifier can be created the tenant must be opted in. To opt in you must be a global admin. After opting in the creation and tanning of the classifiers can be delegated to "Compliance Administrators"

Who can create trainable classifier? Compliance admin and global admin. Who can enable trainable classifier? Global admin. The questions asks "You need to ensure that custom trainable classifiers can be created in the tenant." . So it the answer is C, global admin need to enable the settings so that compliance admin can create the trainable classifier.

https://learn.microsoft.com/en-us/purview/trainable-classifiers-get-started-with#how-to-create-a-trainable-classifier Need Compliance Admin or Security Admin. Compliance is the role with the least privilege of the 2.

As someone who does this for a living, for customers. The answer is D. Compliance Administrator. I'm never given GA access to a company's environment.

Sign in to either the Microsoft Purview portal or the Microsoft Purview compliance portal with either Compliance admin or Security admin role access and navigate to Data loss prevention > Data classification > Classifiers. Choose the Trainable classifiers tab.

To perform the configuration and ensure that custom trainable classifiers can be created in the tenant, you should be assigned to the Compliance administrator (Option D) role.

To configure custom trainable classifiers in your new Microsoft 365 tenant, you should be assigned the **Compliance administrator** role. This role provides the necessary permissions to manage compliance features, including trainable classifiers. By having this role, you'll be able to create and configure custom classifiers to enhance data loss prevention (DLP) and other compliance-related tasks within your organization. Remember to assign this role to the appropriate user account to perform the necessary configuration tasks. 🛡️🔍

Principle of the least privilege, also C is correct.

D. Compliance administrator

NEW tenant - Global admin is required to opt in