A city open-data portal team must give a vendor consultant access to one SharePoint site with least privilege. Which choice best aligns with SharePoint site roles?

A city open-data portal team granting a vendor consultant access to one SharePoint site with least privilege should assign Visitors or a custom read-oriented permission level instead of Owners when only viewing is required. Least privilege means the consultant gets enough rights to do the contracted review on that single site—and no standing administrative rights across the municipal estate.

Assigning the Members group with its default edit permission level when only viewing is required for the review fails because Members can edit, add, and delete content by default, far exceeding a read-only reviewer's need and breaking least privilege even on a single site. Assigning the Visitors group at the tenant level instead of this site when only viewing is required for the review fails because it expands read access beyond the single site in scope to the tenant level, violating least privilege on scope even though the permission level itself is read-oriented. Assigning the consultant site collection administrator for this site collection when only viewing is required fails because a site collection administrator has full administrative control over the entire site collection, which vastly exceeds a read-only reviewer's need and violates least privilege.

Exam caveat: AB-900 least-privilege items punish elevating to Members with its default edit permission level ‘for convenience.’ Prefer Visitors/read permission on the specific site, optionally with time-bounded guest access.

Operational check: invite the consultant as a guest or member identity as policy allows, grant Visitors (or custom read) on only the open-data site in scope, verify the consultant cannot access other municipal sites, set a removal date on the access request ticket, and re-check permissions after the engagement ends so the vendor does not retain lingering read access.