You have an Azure subscription that contains a guest user named User1 and a Microsoft...

In Microsoft Sentinel, incident management and investigation permissions are controlled through Sentinel-specific Azure roles . To allow a user (including a guest user) to triage incidents — meaning they can view, assign, and update incident statuses , but not modify analytics rules or automation logic — the correct Azure role is Microsoft Sentinel Res ponder .

Here’s the breakdown:

1️ ⃣ Azure role → Microsoft Sentinel Responder

The Sentinel Responder role grants permissions to view incidents, update incident status, assign incidents, and run playbooks on incidents.

It follows the principle of least privilege by limiting access to only incident response and not allowing rule creation, workbook management, or data connector configuration.

The Sentinel Contributor role, on the other hand, provides broader permissions (including modifying analytic rules) , which exceeds the requirement of “triaging incidents.”

Therefore, Microsoft Sentinel Responder is the correct and least-privilege Azure role.

2️ ⃣ Azure AD role → Directory readers

To investigate and triage incidents effectively, Sentinel users must be ab le to resolve user identities (such as usernames, group membership, and object IDs) within Microsoft Entra ID (Azure AD).

The Directory Readers role provides read-only access to directory data, allowing the user to view identities but not modify them.

This minimal permission satisfies Sentinel’s identity lookup needs without elevating the user to a global administrative or global reader role.

✅ Final Answers:

Azure role: Microsoft Sentinel Responder

Azure AD role: Directory readers