GuideDefender XDR Unified RBAC
Use Microsoft Defender unified RBAC as the Defender portal permission plane for SOC roles. Keep it separate from Microsoft Entra global roles, Azure RBAC, API permissions, device groups, and Sentinel workspace access.
What Changed
Microsoft Learn describes Defender unified RBAC as the centralized custom-role model for Microsoft Defender XDR and supported Defender workloads. Starting in 2025 it is the default permissions model for new Defender for Endpoint and Defender for Identity tenants. Starting July 2026, it is also the default for new Defender for Office 365 Plan 2 organizations.
Activation matters: until a workload is activated, the workload continues to respect its existing RBAC model. After activation, Defender unified RBAC controls the activated workload permissions in the Defender portal.
Supported Workloads
| Workload | Operational meaning |
|---|
| Defender XDR | Central permissions for Defender XDR experiences in the Microsoft Defender portal. |
| Defender for Endpoint | Full endpoint data and action support. After activation, unified RBAC becomes the source of MDE portal permissions. |
| Defender for Identity | Supported, including scoped access patterns for domains and organizational units. |
| Defender for Office 365 P2 | Supported for security permission management. Microsoft lists unified RBAC as default for new Plan 2 organizations starting July 2026. |
| Defender for Cloud Apps | Integrated with Defender unified RBAC according to Microsoft Learn update history. |
| Defender for Cloud | Cloud scopes and unified RBAC are managed separately from Azure RBAC. |
| Microsoft Sentinel | Supported for Defender portal experiences and selected data lake/scoping scenarios, but Azure RBAC still governs direct workspace access. |
Permission Groups
| Group | Use for |
|---|
| Security operations | Day-to-day SOC operations: security data read, alert management, response actions, and similar investigation workflows. |
| Security posture | Exposure, vulnerability, posture, and secure score style responsibilities. |
| Authorization and settings | Role management, device groups, core security settings, detection tuning, and system settings. |
| Data operations | Preview permissions for Sentinel SIEM and data lake data management, analytics job scheduling, and advanced analytics access. |
Permission Boundaries
| Plane | Boundary |
|---|
| Microsoft Entra global roles | Security Administrator and other global roles can still grant broad Defender portal access. Use unified RBAC to replace broad standing access with scoped operational roles where possible. |
| Defender unified RBAC | Controls activated Defender workloads in the Defender portal. It does not automatically grant Azure resource access. |
| Azure RBAC | Still controls direct Microsoft Sentinel workspace, Log Analytics, Azure resource, and ARM access outside the Defender portal. |
| MDE device groups | Continue to matter for endpoint visibility and actions. Use them with unified RBAC assignments for device-level scope. |
| Sentinel scopes | Preview row-level scoping uses scope tags and unified RBAC assignments to restrict rows returned in Sentinel experiences. |
| API permissions | App registration permissions for Graph, Defender APIs, and ARM are separate from interactive Defender portal RBAC. |
Activation Checklist
- Inventory current Defender for Endpoint, Defender for Identity, Defender for Office 365, and Sentinel role assignments before activation.
- Import or recreate legacy roles where Microsoft supports migration; new 2025 MDE/MDI tenants and new July 2026 MDO P2 organizations may not have old-role export paths.
- Assign roles to Microsoft Entra security groups rather than individual users unless there is a break-glass reason.
- Select data sources deliberately. A role scoped to Defender for Endpoint does not imply equivalent access to Defender for Office 365, Defender for Identity, or Sentinel data.
- For Sentinel activation, verify the operator has Security Administrator plus subscription Owner, or User Access Administrator plus Sentinel Contributor on the workspace.
- Test with a non-admin analyst account in the Defender portal and, separately, against direct Log Analytics/Sentinel access paths.
SC-200 Mapping
| Task | Role design hint |
|---|
| Read incidents across Defender workloads | Security operations > Security data basics (read), scoped to required data sources. |
| Triage and manage alerts | Security data basics (read) plus Alerts (manage) for the selected workloads. |
| Respond from incidents | Security data basics (read), Alerts (manage), and Response (manage), plus any product-specific action constraints such as MDE device group scope. |
| Manage custom detections or indicators | Authorization and settings > Detection tuning (manage), scoped to the relevant data source. |
| Manage Defender portal RBAC | Authorization (read/manage), or Security Administrator in Microsoft Entra ID. |
| Manage Sentinel data lake data | Data operations permissions where applicable, plus the underlying Sentinel workspace and data lake prerequisites. |