Explanation:
Microsoft Entra role: Security Administrator
Role for WS1: Microsoft Sentinel Contributor
To enable User and Entity Behavior Analytics (UEBA) in Microsoft Sentinel , a user must have permission to configure data connectors that access Microsoft Entra ID (Azure AD) identity data and to manage Sentinel settings for the workspace.
This requires roles in two scopes :
1# # Microsoft Entra ID (directory) level - for identity data access.
2# # Sentinel workspace level - for Sentinel feature management.
Step 1: Microsoft Entra (Azure AD) Role # Security Administrator According to Microsoft documentation, enabling UEBA requires connecting Microsoft Sentinel to Microsoft Entra ID to import user and identity behavior data.
The Security Administrator role grants the necessary read permissions to user and sign-in data while still adhering to the principle of least privilege .
* The Global Administrator role would also work but provides excessive privileges beyond what's required for UEBA configuration.
* The Security Operator role is limited to viewing alerts and cannot configure Sentinel connectors.
Hence, Security Administrator is the correct least-privilege directory role.
Step 2: Role for WS1 (Sentinel Workspace) # Microsoft Sentinel Contributor To manage Sentinel configuration and enable features such as UEBA , data connectors , and analytics rules , the Microsoft Sentinel Contributor role is required at the workspace level.
* The Sentinel Contributor role allows enabling/disabling features, managing playbooks, and configuring connectors.
* The Sentinel Automation Contributor role is only for playbook automation permissions.
* The basic Contributor role can manage Azure resources but doesn't grant Sentinel-specific privileges.
# Final answer:
* Microsoft Entra role: Security Administrator
* Role for WS1: Microsoft Sentinel Contributor