Built-in Azure role combining Sentinel Reader rights with managing incidents, such as assigning owners and changing severity or status. Guests additionally need Directory Reader before they can assign incidents.
Read more: Microsoft Learn
In the Ultra Transcenders books
Each book explains Microsoft Sentinel Responder in context, with comparison tables and the common traps.
Terms in this definition
- Role
How an actor normally or expectedly behaves, or the part a person takes in a process. A single actor may hold more than one role.
- Reader
Built-in Azure role for viewing resources only: it cannot modify or use them, for example by joining or associating them, and gives no keys or data access.
- Directory Reader
An Entra role, not an Azure role, allowing basic directory information to be read. Members can already do that by default, though guests might require the role.