Explanation:

In Microsoft Sentinel, incident management and investigation permissions are controlled through Sentinel- specific Azure roles. To allow a user (including a guest user) to triage incidents - meaning they can view, assign, and update incident statuses, but not modify analytics rules or automation logic - the correct Azure role is Microsoft Sentinel Responder.
Here's the breakdown:
1## Azure role # Microsoft Sentinel Responder
* The Sentinel Responder role grants permissions to view incidents, update incident status, assign incidents, and run playbooks on incidents.
* It follows the principle of least privilege by limiting access to only incident response and not allowing rule creation, workbook management, or data connector configuration.
* The Sentinel Contributor role, on the other hand, provides broader permissions (including modifying analytic rules), which exceeds the requirement of "triaging incidents."
* Therefore, Microsoft Sentinel Responder is the correct and least-privilege Azure role.
2## Azure AD role # Directory readers
* To investigate and triage incidents effectively, Sentinel users must be able to resolve user identities (such as usernames, group membership, and object IDs) within Microsoft Entra ID (Azure AD).
* The Directory Readers role provides read-only access to directory data, allowing the user to view identities but not modify them.
* This minimal permission satisfies Sentinel's identity lookup needs without elevating the user to a global administrative or global reader role.
# Final Answers:
* Azure role: Microsoft Sentinel Responder
* Azure AD role: Directory readers