The Security Operator role is part of Microsoft's tiered security roles designed to allow operational security tasks while limiting full administrative privileges.
Per Microsoft Learn ( "Permissions in the Mic rosoft 365 Defender portal" and SC-300 Study Guide ):
"Security Operators can view, investigate, and take actions on security recommendations, alerts, and improvement actions in Microsoft Secure Score." The Security Operator role can update the status of Secure Score improvement actions, making it the appropriate and least-privileged choice for this scenario.

Explanation:

According to the Microsoft SC-300: Identity and Access Administrator Study Guide and Microsoft Learn module "Implement and manage enterprise applications," when developing an application that needs to access Microsoft Graph or other protected APIs on behalf of an organization, you must perform several configuration steps within Azure Active Directory (Azure AD).
Step 1 - Create an app registration:
Every application that requires access to Microsoft Graph must be registered in Azure AD. The registration process establishes an identity for the app and generates an Application (client) ID and a directory (tenant) ID.
This is done in Azure portal # Azure Active Directory # App registrations # New registration . This enables Azure AD to issue tokens to the app.
Step 2 - Add app permissions:
After registration, you must configure permissions under API permissions in the app's registration settings.
For server-to-server access (no user sign-in), Application permissions are used; for delegated access (on behalf of a user), Delegated permissions are added. In this case, since App1 will read directory data from Microsoft Graph, you assign the Microsoft Graph # Directory.Read.All permission.
Step 3 - Grant admin consent:
Application permissions require admin consent before the app can access directory data. An Azure AD administrator must grant these permissions by selecting "Grant admin consent for contoso.com." This allows the app to use the permissions organization-wide.
From Microsoft's documentation:
"To enable an application to call Microsoft Graph, register the app, configure required API permissions, and grant admin consent for those permissions."
# Correct Answer Order:
* Create an app registration
* Add app permissions
* Grant admin consent

Explanation:

In Microsoft Entra Permissions Management (formerly CloudKnox), onboarding an Azure subscription requires granting the Permissions Management service principal the minimum rights needed to discover identities, roles, and permissions across that subscription. The SC-300 materials emphasize the principle of least privilege for onboarding: assign Reader at the subscription scope so the service can inventory resources and permissions without the ability to change them. After onboarding, if you want automated remediation/right-sizing, you can additionally grant User Access Administrator (or perform changes manually), but that elevation is not required merely to onboard and collect data.
Accordingly, you complete the PowerShell by creating an RBAC assignment for the application (service principal) at the subscription scope using New-AzRoleAssignment and specifying -RoleDefinitionName Reader . Creating a new custom role ( New-AzRoleDefinition ) is unnecessary, and New-AzTag is unrelated to RBAC. Choosing Owner or Contributor would ex ceed the access required for onboarding and violate least-privilege guidance. The correct, minimal configuration is therefore: assign Reader to the Permissions Management application at the /subscriptions/ < SubscriptionId > scope using New-AzRoleAssignment .

Explanation:
User
Can Reset Passwords For
User1
User3 and User5 only
User4
User3 only
According to the Microsoft SC-300: Microsoft Identity and Access Administrator Study Guide and official Microsoft Learn documentation on role-based access control (RBAC) and administrative units (AUs) , the scope of administrative privileges determines which users an administrator can manage.
Role Review:
* Password Administrator (Organization scope): Can reset passwords for non-administrators and users with lesser pri vileges across the entire organization. They cannot reset passwords for Global Administrators or users with equal/higher roles.
* Global Reader (Organization scope): Read-only access-cannot perform administrative actions (including password resets).
* Password Administrator (Scoped to AU1): Can reset passwords for users within AU1 who are non- administrators and whose roles are less privileged than their own.
User
Role
Scope
Members in Administrative Unit
User1
Password Administrator
Organization
AU1
User2
Global Reader
Organization
AU1
User3
None
N/A
AU1
User4
Password Administrator
AU1
AU2
User5
None
N/A
None
Step 1 - For User1 (Org-scoped Password Administrator): User1's permissions apply organization-wide, allowing resets for:
* Users without admin roles, including those in or outside any AU.
* Cannot reset passwords for users with equal or higher roles (e.g., Global Reader, Password Administrator).
# Therefore, User1 can reset passwords for:
* User3 (no role, AU1)
* User4 (Password Administrator in AU2) - # cannot reset equal role
* User5 (no role, no AU) #
Final for User1 # User3 and User5 only
Step 2 - For User4 (AU1-scoped Password Administrator): User4's permissions apply only within AU1 and to users with lesser privileges.
Within AU1:
* User1 (Org Password Admin) - # higher privilege
* User2 (Global Reader) - # higher privilege
* User3 (no role) - # can reset
Final for User4 # User3 only

According to the Microsoft SC-300: Identity and Access Administrator Study Guide, the enforcement of Modern Authentication for Microsoft 365 services such as Exchange Online is achieved through Conditional Access policies. Conditional Access allows you to block legacy authentication protocols (such as POP, IMAP, SMTP, and MAPI over HTTP) that use Basic Authentication, and require Modern Authentication (OAuth 2.0) instead.
Microsoft Learn explains that you can configure a policy that "blocks access requests using legacy authentication clients" under Conditions # Client apps and select "Other clients (legacy authentication clients)" to enforce Modern Authentication. Defender for Cloud Apps OAuth policies and Intune app
/compliance policies do not control authentication protocols at the tenant level.