mediumMultiple ChoiceObjective-mapped
MS-102 Practice Question: A junior administrator needs permission to view…
A junior administrator needs permission to view sign-in logs, audit logs, and security recommendations in the Microsoft Entra admin center, but must not be able to reset passwords, modify settings, or manage roles. Which built-in Microsoft Entra role should the administrator assign?
⚠ Common exam trap
Test-takers frequently confuse the Security Reader role with the Security Administrator role, mistakenly assuming that viewing security recommendations requires write permissions, or they overlook the legacy Reports Reader role which does not cover all required log types.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Security Reader
The Security Reader role grants read-only access to security-related data, including sign-in logs, audit logs, and security recommendations, without permitting any write operations such as password resets, setting modifications, or role management. This aligns precisely with the junior administrator's required permissions.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Global Reader
Why it's wrong here
Global Reader grants read-only access to every administrative setting in Entra ID, including tenant configuration, billing data, user profiles, and partner relationships. While it can technically view sign-in logs, it is far broader than the junior administrator's requirement, exposing sensitive information unrelated to sign-in activity. Least privilege demands a role scoped to the specific logs needed, not one that allows browsing the entire tenant's administrative surface.
- ✓
Security Reader
Why this is correct
Security Reader is the correct built-in role because it provides read-only access to security-related signals, including Entra ID sign-in logs, audit logs, and identity risk events. It does not allow any modification of security settings or password resets, so the junior administrator can inspect sign-in activity while remaining unable to alter configurations. This aligns precisely with the least-privilege principle for a view-only task.
- ✗
Reports Reader
Why it's wrong here
Reports Reader is designed for viewing Microsoft 365 usage analytics and adoption reports, and while it can access audit logs, it does not provide the full read-scope over Entra ID sign-in log details such as conditional access evaluations, risk levels, or device information. A sign-in log is an identity security signal, not a usage report, so this role lacks the dedicated permission to comprehensively read that data. It is therefore insufficient for the stated need.
- ✗
Security Administrator
Why it's wrong here
Security Administrator has read/write control over security features, including conditional access policies, security alerts, and delegated privileges, and it can also reset passwords. Granting this role to read sign-in logs would give the junior administrator the ability to change security settings and perform user-impacting actions, creating a significant privilege escalation risk. Since the requirement is read-only, this role is overly permissive and violates least privilege.
Go deeper
Related to this question
Learn chapter
Microsoft 365 Tenant Setup
Key term
Audit
An audit is a systematic, independent review of IT systems, processes, and controls to verify compliance with policies, standards, and regulations.
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
About these practice questions
This MS-102 question is part of Courseiva's 241-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MS-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MS-102 exam.