Microsoft Security, Compliance, and Identity Fundamentals SC-900 Practice Question

The Security Reader role grants read-only access to security-related information in Microsoft Entra ID, including sign-in logs, Conditional Access insights, and Identity Protection risk reports. It does not allow the holder to change policies, manage users, or perform administrative actions, satisfying the requirement.

• The Security Operator role allows additional actions such as dismissing or resolving alerts, so it offers more permissions than needed.
• Global Reader provides read-only access to all directory settings across Microsoft 365, which exceeds the scope of the analyst's duties and violates least-privilege principles.
• Conditional Access Administrator can create or modify Conditional Access policies, which conflicts with the requirement to prevent changes. Therefore, Security Reader is the most appropriate choice.