You have a Microsoft 365 E5 subscription that contains a user named User1. You deploy Microsoft Purview Data Security Posture Management for AD (DSPM…

The Security Reader role is an Azure Active Directory built-in role designed to provide read-only access to various security and compliance features across the Microsoft 365 subscription. Assigning this role to User1 allows them to view security information, reports, and configurations, including the auditing status, within the Microsoft Purview compliance portal and Microsoft 365 Defender portal. This fulfills the requirement to verify the status without granting any administrative or modification permissions, thereby strictly adhering to the principle of least privilege. The role's scope is appropriate for a subscription-wide check, unlike more specialized or service-specific roles.

A. Insider Risk Management Analysts: This role is scoped specifically to the Insider Risk Management solution for viewing alerts and cases, not for general subscription auditing status.

C. Insider Risk Management Investigators: This role grants higher privileges within the Insider Risk Management solution, including viewing content, which is excessive for just verifying audit status.

D. View-Only Organization Management for Microsoft Exchange Online: This is a read-only role, but its scope is limited to Microsoft Exchange Online configuration and is not suitable for verifying the entire subscription's auditing status.

1. Microsoft Learn. "Azure AD built-in roles." Microsoft Entra Documentation. Accessed May 22, 2024. Under the "Security Reader" section, it states, "Users with this role have global read-only access... This includes read-only access to all features in Microsoft 365 Defender portal, Azure Active Directory, Identity Protection, Privileged Identity Management, and Microsoft Purview compliance portal." This confirms its suitability for viewing auditing status.

2. Microsoft Learn. "Permissions in the Microsoft Purview compliance portal." Microsoft Purview Documentation. Accessed May 22, 2024. This document outlines the various roles and their permissions, showing that roles like Security Reader have broad, read-only access appropriate for auditing tasks, while other roles are more specific.

3. Microsoft Learn. "Permissions for Microsoft Purview Insider Risk Management." Microsoft Purview Documentation. Accessed May 22, 2024. This source details the specific permissions for the "Insider Risk Management Analysts" and "Insider Risk Management Investigators" role groups, confirming they are scoped only to the insider risk management solution.

4. Microsoft Learn. "View-Only Organization Management." Exchange Online Documentation. Accessed May 22, 2024. This document describes the View-Only Organization Management role, clarifying that its permissions are limited to viewing the configuration of objects within an Exchange Online organization.