Deploying a Microsoft Sentinel workbook template creates a workbook resource inside the Sentinel-enabled Log Analytics workspace. Microsoft’s RBAC table specifies that the Microsoft Sentinel Contributor role is the minimum role that can 1) create (deploy), 2) edit, and 3) delete Microsoft Sentinel workbooks while giving no wider rights such as role assignment. Workbook Contributor can edit Azure Monitor workbooks but has no access to the Sentinel portal or data; Contributor is broader than necessary; Microsoft Sentinel Automation Contributor is limited to playbooks. Therefore, assigning Microsoft Sentinel Contributor to User1 on RG1 satisfies the requirement with least privilege.

A. Workbook Contributor – Can manage Azure Monitor workbooks but lacks permission to open Microsoft Sentinel or deploy Sentinel workbook templates.
C. Contributor – Grants full management of all resource types in RG1, exceeding least-privilege needs.
D. Microsoft Sentinel Automation Contributor – Permits creation and editing of playbooks only; no rights over workbooks.

1. Microsoft Learn – “Permissions in Microsoft Sentinel” → Table: Microsoft Sentinel Contributor – “Create, update, and delete … workbooks” (2023-10-31 version, section ‘Built-in roles’).

2. Microsoft Learn – “Tutorial: Use Microsoft Sentinel workbooks” → Prerequisites: “You must be assigned the Microsoft Sentinel Contributor role (or higher) to create or edit workbooks.” (2023-09-18, first paragraph).

3. Microsoft Learn – “Azure built-in roles – Workbook Contributor” → Description shows scope restricted to Azure Monitor workbooks, not Sentinel (2024-02-05, role definition page).