Describe Microsoft 365 apps and services →hardMultiple Choice

MS-900 Describe Microsoft 365 apps and services Practice Question

Exhibit

{
  "roleName": "Compliance Administrator",
  "permissions": [
    "microsoft.office365.securityComplianceCenter/allEntities/allTasks",
    "microsoft.office365.protectionCenter/allEntities/allTasks"
  ]
}

Refer to the exhibit. You are reviewing a role definition in Microsoft Purview compliance portal. Which actions can a user assigned this role perform?

⚠ Common exam trap

Many candidates confuse the scopes of Microsoft Purview, Microsoft Entra ID, and Microsoft Defender XDR, assuming a single admin role covers all security and compliance tasks, when in fact each portal has its own distinct RBAC model and role assignments.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Manage compliance and data governance tasks in Microsoft Purview

The question refers to a role definition in the Microsoft Purview compliance portal. The Compliance Administrator role (or a custom role with equivalent permissions) is designed specifically to manage compliance and data governance tasks, such as data classification, data loss prevention (DLP), eDiscovery, and retention policies. Option A correctly identifies this scope, as Purview roles do not extend to identity management or security operations in other portals.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
Manage compliance and data governance tasks in Microsoft Purview
Why this is correct
This role definition grants the 'allTasks' permission, which provides full control across the Security & Compliance Center and Protection Center interfaces now consolidated in Microsoft Purview. With full management capability, the holder can configure retention policies, data loss prevention rules, eDiscovery cases, and other compliance data governance workloads. Because the role includes every task rather than a read-only scope, it is correctly identified as managing compliance and data governance tasks.
✗
Manage user accounts in Microsoft Entra ID
Why it's wrong here
Managing user accounts in Microsoft Entra ID involves creating and disabling directory users, resetting passwords, and assigning licenses through the Entra admin center or Microsoft Graph. The role defined in the exhibit is scoped exclusively to Microsoft Purview's compliance and data governance workloads, not to identity objects or directory configuration. Identity administration requires an Entra role such as User Administrator or Global Administrator, which this compliance-scoped role does not include.
✗
Manage security settings in Microsoft Defender XDR
Why it's wrong here
Security settings in Microsoft Defender XDR focus on threat protection, including endpoint policies, vulnerability management, incident response, and attack surface reduction in security.microsoft.com. Although Defender XDR is a security administration plane, the role in the exhibit is scoped to compliance and protection in Purview, not to these security operations tasks. Security settings management requires Defender roles like Security Administrator, whereas the 'allTasks' permission here applies only to Purview compliance workloads.
✗
View only compliance reports without making changes
Why it's wrong here
A read-only role would only contain view tasks, such as View-Only Recipients or View-Only Audit Logs, allowing the holder to examine compliance reports without modifying settings. The role definition in the exhibit, however, includes 'allTasks,' which is a superset permission granting full create, edit, read, and delete capabilities across Purview. Therefore, this role is far more powerful than a viewer and cannot be described as view-only compliance reporting.

Go deeper

MS-900 Describe Microsoft 365 apps and services Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question