A healthcare company uses SD-WAN Manager with three teams: helpdesk needs read-only monitoring, network engineers need policy and template changes, and auditors need reports without configuration rights. A shared admin account violates compliance. Which access control should the administrator configure to enforce least privilege?

Least privilege in SD-WAN Manager requires mapping each job function to only the permissions needed, which user groups with role-based access control achieve by giving helpdesk read-only monitoring, engineers policy and template rights, and auditors reporting without configuration while eliminating the shared admin account for individual accountability. Single sign-on with multifactor authentication strengthens identity assurance and replaces shared credentials with auditable individual logins, yet authentication alone does not authorize differentiated actions so helpdesk, engineers, and auditors would still share the same effective privilege. Creating read-only monitoring and reporting roles correctly enforces least privilege for helpdesk and auditors and preserves evidence collection, yet it leaves network engineers unable to perform their core policy and template duties and forces either privilege escalation workarounds or operational blockage. Provisioning separate management domains isolates teams administratively and appears compliant, yet granting full privileges within each domain overprovisions helpdesk and especially auditors with configuration rights that violate least privilege and healthcare compliance. An exam caveat is to distinguish authentication and domain isolation from authorization, since questions mentioning differentiated duties and least privilege almost always demand role scoping rather than stronger login or separation alone. As a practical check, validate in the lab that each group member can access only its menu and API actions, confirm auditors cannot reach configuration commits, and review AAA logs to prove individual accountability.