What permission do I need to access Microsoft Defender - Incidents?

Question

I'm currently accessing a incident on our environment but I can't access it. It gives my this error message.

"You can’t access this section.

Sorry, you can’t access this section. Check with your administrator for the role-based access permissions to see the data."

I'm already a Security admin but still can't access.

Answer 1

Hi @GeneR , as a Security Admin you should have access to this. However, there are a few things you can check to ensure that you have the necessary permissions to access the incidents:

1. Make sure that you are assigned the Security Admin role in the Azure portal. You can check this by going to Azure Active Directory > Roles and administrators > Security Admins. If you are not assigned this role, you will need to have an administrator assign it to you.
2. Check if there are any custom roles or policies that are blocking your access to the incidents. You can check this by going to Azure Active Directory > Roles and administrators > Conditional Access. If there are any policies that are blocking your access, you will need to have an administrator modify them to allow your access.
3. Ensure that you have the necessary permissions to access the specific incident you are trying to view. You can check this by going to Microsoft Defender Security Center > Incidents > Select the incident > Permissions. If you do not have the necessary permissions, you will need to have an administrator modify them to allow your access.

If this still doesn't work please let me know and I can help you further.

Please let me know if you have any questions and I can help you further.

If this answer helps you please mark "Accept Answer" so other users can reference it.

Thank you,

James