Configure Unified RBAC for Microsoft Defender for Office 365

Microsoft Defender unified role-based access control (RBAC) provides a single permission model for all Defender workloads, including Microsoft Defender for Office 365. Unified RBAC replaces legacy Email & collaboration roles with granular permissions, custom role design, and precise control over investigation and remediation access.

What you need

• Microsoft Defender for Office 365 Plan 2.
• At least the Security Administrator role in Microsoft Entra ID (to activate Unified RBAC).
• About 20 to 30 minutes to complete the configuration.

Understand the scope

Before you start, understand what Unified RBAC controls and what it doesn't:

Before and after activation

The following table summarizes what changes and what stays the same when you activate Unified RBAC for Defender for Office 365:

Step 1: Evaluate Microsoft Entra role mappings

If your organization already uses Microsoft Entra roles, evaluate whether those roles provide sufficient access before you create custom roles:

For the complete Microsoft Entra role-to-Unified RBAC permission mapping, see Microsoft Entra global roles access.

Step 2: Create custom roles

If you need more granular access control, create custom roles in the Defender portal:

1. On the Microsoft Defender XDR Permissions and roles page in the Defender portal at https://security.microsoft.com/mtp_roles, select Create custom role.

2. The custom role wizard opens. On the Set up the basics page, configure the following information:

   • Role name: Enter a unique, descriptive role name (for example, MDO SOC Analyst).
   • Description: Enter an optional description.

   When you're finished on the Set up the basics page, select Next.

3. On the Choose permissions page, select the permissions for the role. For guidance, see the persona templates section.

   1. Select an available permission group:

      • Security operations
      • Security posture
      • Authorization and settings
      • Data operations
      • AI code security

   2. In the permission group details flyout that opens, select the permissions. To clear your selections and start over in the flyout, select Clear all permissions.

      The following screenshot shows the details flyout for the Security operations permission group:

      

      When you're finished selecting permissions in the permission group details flyout, select Apply.

   3. Back on the Choose permissions page, repeat the previous steps as many times as necessary.

   When you're finished on the Choose permissions page, select Next.

4. On the Assign users and data sources page, select Create assignment or Add assignment to assign users or groups to the role.

   In the Add assignment flyout that opens, configure the following options:

   • Assignment name: Enter a unique, descriptive name.

   • Employees: Start typing a user or group name in the box to filter the list, or click in the empty box to see the full list. Select a user or group from the list, and it appears in the box. Repeat this step as many times as necessary.

   • Data sources: Verify that Microsoft Defender for Office 365 is selected.

     Tip

     Depending on your Microsoft 365 subscription, other workloads might also be available and selected (for example, Microsoft Defender for Endpoint).

   • Include future data sources automatically: This option is selected by default.

   When you're finished on the Assign users and data sources page, select Next.

5. On the Review and finish page, review the settings. You can select Edit in each section to modify the settings within the section. Or you can select Back or the specific page in the wizard.

   When you're finished on the Review and finish page, select Submit.

6. After the role is created, select Done.

For more information, see Create custom roles in Microsoft Defender unified RBAC.

Persona templates

Use the following templates as starting points for common security roles. Adjust permissions based on your organization's needs.

Defender for Office 365 Security Administrator (full access)

Full control over all Defender for Office 365 settings, investigations, and response actions.

Security Analyst (investigate and remediate)

Investigate threats and take response actions without policy management access.

SOC Tier 1 Operator (triage only)

Triage alerts and manage quarantine without remediation or content access.

Compliance/Audit Reader (read-only)

View policies, settings, and email metadata without the ability to take actions.

Tenant Allow/Block List Manager

Manage allow and block entries without broader policy or investigation access.

SOC 3-tier model

For organizations with tiered security operations center (SOC) teams, use the following model and deployment steps:

1. Create Microsoft Entra security groups for each tier (for example, MDO-SOC-Tier1, MDO-SOC-Tier2, MDO-SOC-Tier3).
2. Create the three custom roles with the permissions shown in the table.
3. Assign the corresponding security group to each role.

Step 3: Assign roles

1. On the Roles page in the Defender portal, select the role, and then select Edit.
2. Go to the Assignments tab.
3. Add users, groups, or select all users as needed.
4. Optionally, scope the role to specific workloads (for example, Defender for Office 365 only).
5. Save the assignment.

Step 4: Activate Unified RBAC

1. On the Microsoft Defender XDR Permissions and roles page in the Defender portal at https://security.microsoft.com/mtp_roles, do one of the following steps:

   • Select Activate workloads in the banner.
   • Select Workload settings at the top of the page.

2. In the Email & collaboration section of the Activate unified role-based access control flyout or page that opens, slide the Defender for Office 365 toggle to Active.

   Tip

   Sliding the Exchange Online permissions toggle to Active also brings Exchange Online permissions under Unified RBAC.

3. Select Activate on the confirmation message.

For more information, see Activate Microsoft Defender unified RBAC.

Step 5: Verify access

After activation, verify that users have the correct access:

Step 6: Understand features outside Unified RBAC scope

Unified RBAC doesn't control the following features, which require separate role assignments:

Step 7: Migrate from legacy roles (existing organizations)

For existing organizations that already use Email & collaboration roles, choose between the import and rebuild approaches to migrate your roles. The following table can help you decide:

Option A: Import existing roles

Use the import feature for a fast migration that preserves your current role structure. You select the product to import from (for example, Email & collaboration), choose specific roles, and submit. For detailed steps, see Import existing roles to Microsoft Defender unified RBAC.

Option B: Rebuild roles

Use the rebuild approach to simplify and align roles with SOC personas:

1. Audit your current roles and their members.
2. Map roles to the persona templates in this article.
3. Create new custom roles.
4. Assign users and groups.

Troubleshooting

The following table lists common issues after Unified RBAC activation and how to resolve them:

Next steps

• Unified RBAC permissions for Defender for Office 365
• Permissions in Microsoft Defender unified RBAC
• Create custom roles in Microsoft Defender unified RBAC
• Activate Microsoft Defender unified RBAC
• Import existing roles