Sentinel data lake access: Entra roles vs Azure RBAC vs table scoping

This sheet compares Entra ID directory role, Azure RBAC workspace role, Table-level or resource-context RBAC, Defender XDR unified RBAC role.

CriterionEntra ID directory roleAzure RBAC workspace roleTable-level or resource-context RBACDefender XDR unified RBAC role
ScopeAll data lake workspaces (tenant-wide)One workspaceSpecific tables in one workspaceSentinel data collection in Defender

The verdict, the full comparison, 5 rules and 2 traps are part of SC-200 access. Unlock SC-200.