Manage a security operations environment →mediumMultiple Choice

SC-200 Manage a security operations environment Practice Question

Your organization uses Microsoft Sentinel and Microsoft Defender XDR. You need to ensure that an external user from a partner organization can access a specific Sentinel workbook without having access to the entire Log Analytics workspace. What should you do?

⚠ Common exam trap

Watch out — candidates often confuse sharing a workbook (which requires RBAC on the workbook resource) with sharing a dashboard (which is a visual-only artifact in the Azure portal and does not grant any data access permissions).

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Use Microsoft Entra B2B collaboration to invite the external user and assign the Sentinel Reader role on the workbook.

Microsoft Entra B2B collaboration allows you to invite an external user from a partner organization into your Microsoft Entra ID tenant. By assigning the Sentinel Reader role specifically on the workbook resource (not the workspace), the user can view the workbook without gaining access to the underlying Log Analytics workspace data or other Sentinel resources. This meets the requirement of granular, scoped access.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Create a new Log Analytics workspace dedicated to the external partner and deploy the workbook there.
Why it's wrong here
Creating a separate Log Analytics workspace for the external partner would duplicate data and incur additional ingestion and retention costs. It also misses the root issue: the partner needs controlled access to the existing workbook, not a new environment. Even in the new workspace, you would still need to use Microsoft Entra B2B invitations and assign appropriate RBAC roles, making this approach unnecessarily complex and inefficient.
✓
Use Microsoft Entra B2B collaboration to invite the external user and assign the Sentinel Reader role on the workbook.
Why this is correct
Microsoft Entra B2B collaboration is the correct solution because it lets you invite the external user as a guest in your tenant, preserving their own corporate credentials while giving them scoped access. Assigning the Sentinel Reader role specifically on the workbook grants read-only visibility to that workbook without exposing the underlying Log Analytics workspace data or allowing any modifications. This provides fine-grained, auditable access control exactly suited to secure external sharing.
✗
Share the workbook as a shared dashboard in the Azure portal.
Why it's wrong here
Sharing the workbook as a shared dashboard in the Azure portal is incorrect because workbooks are interactive resources, and dashboards are static views that do not support the same RBAC granularity. A shared dashboard with an external user would require that user to have a guest account and may inadvertently reveal underlying workspace queries or data when rendered. This approach cannot restrict access to only the workbook, so it fails the principle of least privilege.
✗
Add the external user to the resource group containing the workspace with Reader role.
Why it's wrong here
Adding the external user to the resource group containing the workspace with the Reader role grants permissions across every resource in that group, including the Log Analytics workspace itself. With Reader on the workspace, the user could view sensitive logs and query results, not just the workbook. This broad scope violates least-privilege security practices and exposes far more data than intended, so it is an insecure sharing method.

Go deeper

SC-200 Manage a security operations environment Practice Question

Why each option matters

Option-by-option breakdown

Related to this question