Microsoft Azure Security Engineer Associate AZ-500 Practice Question

To establish the connection, you must be able to enable the Defender for DevOps plan at the subscription level and authorize the Defender for Cloud app in the Azure DevOps organization. Subscription Owner, Contributor, and Security Admin roles have the necessary write access in Azure. Within Azure DevOps, only members of the Project Collection Administrators group can grant tenant-wide consent for an external application. Reader, Security Reader, and User Access Administrator roles lack the ability to modify Defender plans, and lower-level Azure DevOps roles such as Project Administrator or Stakeholder cannot install or authorize an organization-wide app.