AZ-120: Planning and Administering Azure for SAP WorkloadsDemo

By Microsoft · Question Mode

QuestionQ274

Design and implement an infrastructure to support SAP workloads on Azure

You have an Azure subscription named Sub1 that contains a Microsoft Sentinel workspace named Workspace1.

An SAP RISE managed workload is integrated with Sub1.

You plan to deploy the Microsoft Sentinel solution for SAP applications and use automated attack disruption in Microsoft Defender XDR.

You need to ensure that the SAP connector can access Workspace1 and the managed workload, while following the principle of least privilege.

Which roles should be assigned to the managed workload and connector for Workspace1?

Select
Workspace1:
Managed workload:
Explanation

The managed identity for the SAP data connector agent requires the Reader and Microsoft Sentinel Business Applications Agent Operator roles on the Sentinel workspace’s business-application-agent scope. The SAP connector user requires the /MSFTSEN/SENTINEL_RESPONDER role, which contains the authorizations used to retrieve SAP logs. These assignments provide the required access without granting broader Contributor or automation permissions.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!