Exam SC-200 topic 3 question 59 discussion

guess it should be 'reader' with 'managed' see https://learn.microsoft.com/en-us/azure/sentinel/authenticate-playbooks-to-sentinel#authenticate-with-managed-identity

A managed identity Microsoft Sentinel Reader

ChatGTP: ✅ Answer: Role to assign: Microsoft Sentinel Responder Scope to assign the role: Resource group that contains the Sentinel workspace 🧠 Explanation: Microsoft Sentinel Responder Can view incidents and update their status or comments, which is sufficient for triggering actions in a logic app when incidents are created. Cannot create analytics rules, workbooks, or change workspace settings, so it aligns well with least privilege. Scope at resource group level: This limits the permissions to just the resource group that contains sws1, again helping follow least privilege.

Managed identity Microsoft Sentinel Reader

Based on the Sentinel role permission (RBAC), I think the answers are: - Managed Identity - Sentinel Responder (because this can assign incident as outlined below) Microsoft Sentinel Responder can, in addition to the above, manage incidents (assign, dismiss, etc.).

I hate these kind of questions. Honestly I can't tell what is "easier" a managed identity or a service principal. I know that the documentation says service principal is preffered. Sigh....

Correct Option

Correct answer

The same scenario tells you that the logic app is going to generate an incident. "You plan to create an Azure logic app that will raise an incident..." The reader can only view incidents, the responder has the ability to generate them. The suggested answer is correct.

I would say: Service principle since that can be assigned the least privilege without having to create a user in the AD. Since no automation creation of incident handling is needed, sentinel reader role would suffice

A managed identity Microsoft Sentinel Reader

Answer is correct. https://learn.microsoft.com/en-us/azure/sentinel/authenticate-playbooks-to-sentinel#authenticate-with-managed-identity https://learn.microsoft.com/en-us/azure/sentinel/roles#microsoft-sentinel-specific-roles