Roles in Microsoft Sentinel are designed for least privilege. The Azure Sentinel Responder role allows analysts to view, assign, update, and dismiss incidents, change status/severity, and add comments-exactly the actions a Tier-1/Tier-2 analyst needs for day-to-day triage. Azure Sentinel Reader is view-only and cannot change incident state. Azure Sentinel Contributor is broader than needed (it includes creating/editing analytics rules and other configuration). Logic App Contributor pertains to playbook authoring, not incident handling. Therefore, to let a new analyst assign and dismiss incidents while honoring least privilege, assign Azure Sentinel Responder.