Microsoft Defender Unified RBAC
Microsoft Defender unified role-based access control centralizes custom role assignment for Defender XDR, Defender for Endpoint, Defender for Identity, Defender for Office 365 P2, Defender for Cloud Apps, Defender for Cloud, Security Exposure Management, and selected Microsoft Sentinel experiences in the Defender portal.
capabilitiesCurrent
Relationships
Configuration Methods
| Method | Support | Reference or Gap |
|---|---|---|
| Portal | Supported | Reference |
| PowerShell | Gap | Microsoft Learn documents Defender unified RBAC management through the Microsoft Defender portal, not a dedicated PowerShell desired-state surface. |
| REST API | Gap | No public Defender unified RBAC role-management REST API is recorded in the site data. Use documented portal workflows and validate any tenant-specific automation separately. |
| Graph | Gap | Microsoft Graph security API permissions are separate from Defender unified RBAC portal roles. |
| ARM | Gap | Defender unified RBAC is managed in the Defender portal. Azure RBAC still governs direct Azure resource and Log Analytics workspace access. |
| Bicep | Gap | No Bicep resource is recorded for Defender unified RBAC roles. |
| Terraform | Gap | No Terraform resource is recorded for Defender unified RBAC roles. Model the desired role matrix as design documentation and verify assignment state in the Defender portal. |
| GitHub Actions | Gap | No first-party GitHub Actions deployment path is recorded for Defender unified RBAC roles. |
| Azure DevOps | Gap | No first-party Azure DevOps deployment path is recorded for Defender unified RBAC roles. |