Microsoft Security Operations Analyst Associate SC-200 Practice Question

Security Copilot provides four built-in application roles that can be assigned in Microsoft Entra ID:

• Security Copilot Administrator - full control, including managing settings, plugins, and access assignments.
• Security Copilot Contributor - can interact with Copilot, upload data, and create or run promptbooks, but cannot manage plugins, workspace settings, or role assignments.
• Security Copilot Responder - can run prompts and view responses but cannot create promptbooks.
• Security Copilot Reader - can only view existing content.

Because the SOC analysts need to create and run promptbooks and upload investigation data, they require more than Reader or Responder rights. However, they must be prevented from tenant-level administration, so the Administrator role is too permissive. The Contributor role meets all requirements without granting unnecessary administrative privileges, making it the correct choice.