SC-401 Administering Information Security in Microsoft 365

To meet the requirement that all administrative users must be able to create Microsoft 365 sensitivity labels, we need to assign the Sensitivity Label Administrator role to the correct users. Sensitivity Label Administrator Role Responsibilities This role allows users to: ● Create and manage sensitivity labels in Microsoft Purview. ● Publish and configure auto-labeling policies. ● Modify label encryption and content marking settings. Review of Admin Roles from the Table:

Answer Area

Admin	Role Assigned	Can Create Sensitivity Labels?
Admin1	Global Reader	No, read-only permissions.
Admin2	Compliance Data Administrator	Yes, can manage compliance data, including labels.
Admin3	Compliance Administrator	Yes, has full compliance management, including labels.
Admin4	Security Operator	No, this role is focused on security alerts and response.
Admin5	Security Administrator	No, primarily focused on security policies and threat management.

Explanation
Admin1 (Global Reader): This role provides read-only access across the tenant. Users assigned this role can view settings and administrative data but cannot create or modify objects, including sensitivity labels.
Admin2 (Compliance Data Administrator): This role possesses permissions explicitly geared towards data governance and classification tasks, which include creating, managing, and publishing sensitivity labels.
Admin3 (Compliance Administrator): As a high-level administrative role for compliance features, it grants comprehensive permissions to configure and manage all compliance-related settings, directly allowing the creation of sensitivity labels.
Admin4 (Security Operator): This role is designated for operational security tasks, such as monitoring alerts and analyzing potential threats. It does not contain administrative permissions required to configure data classification or compliance policies like sensitivity labels.
Admin5 (Security Administrator): While this role grants broad security management privileges (such as managing threat policies and security alerts), it does not natively inherit full compliance creation privileges. Data classification and sensitivity management are handled within the compliance/purview scope, making it an incorrect role for creating sensitivity labels unless combined with proper compliance role groups.

Users that must be assigned the Sensitivity Label Administrator role: ● Admin2 (Compliance Data Administrator) ● Admin3 (Compliance Administrator) ● Admin1 (Global Reader) (should be assigned this role to fulfill the requirement that all admins can create labels).