Set up RBAC permissions to access site security
The Microsoft Defender portal allows granular access to features and data based on user roles and the permissions given to each user with Role-Based Access Control (RBAC).
To access the Microsoft Defender for IoT features in the Defender portal, such as site security, and Defender for IoT specific alerts and vulnerability updates, you need to assign permissions and roles to the correct users.
This article shows you how to set up the new roles and permissions to access the site security and Defender for IoT specific features.
To make general changes to RBAC roles and permissions that relate to all other areas of Defender for IoT, see configure general RBAC permissions.
Important
This article discusses Microsoft Defender for IoT in the Defender portal (Preview).
If you're an existing customer working on the classic Defender for IoT portal (Azure portal), see the Defender for IoT on Azure documentation.
Learn more about the Defender for IoT management portals.
Some information in this article relates to a prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, with respect to the information provided here.
Prerequisites
- Review the general prerequisites for Microsoft Defender for IoT.
- Details of all users to be assigned site security permissions.
Access management options
There are three ways to manage user access to the Defender portal, depending on the type of tenent you're using. Each system has different named permissions that allow access for site security. The systems are:
- Global Microsoft Entra roles.
- Microsoft Defender XDR Unified RBAC: Use Defender XDR Unified role-based access control (RBAC) to manage access to specific data, tasks, and capabilities in the Defender portal.
- Microsoft Defender for Endpoint XDR RBAC: Use Defender for Endpoint XDR role-based access control (RBAC) to manage access to specific data, tasks, and capabilities in the Defender portal.
The instructions and permission settings listed in this article apply to both Defender XDR Unified and Microsoft Defender for Endpoint XDR RBAC.
Set up Defender XDR Unified RBAC roles for site security
Assign RBAC permissions and roles, based on the summary table, to give users access to site security features:
In the Defender portal, select Settings > Microsoft Defender XDR > Permissions and roles.
Enable Endpoints & Vulnerability Management.
Select Go to Permissions and roles.
Select Create custom role.
Type a Role name, and then select Next for Permissions.
For read permissions, select Security operations, and select Select custom permissions.
In Security data, select Security data basics(read) and select Apply.
For write permissions, in Authorization and settings, select Select custom permissions.
In Security data, select Core security settings (manage) and select Apply.
Select Next for Assignments.
Select Add assignment, type a name, choose users and groups and select the Data sources.
Select Add.
Select Next to Review and finish.
Select Submit.
Set up Microsoft Defender for Endpoint XDR RBAC (Version 2) roles for site security
Assign RBAC permissions and roles, based on the summary table, to give users access to site security features:
In the Defender portal, select Settings > Endpoints > Roles.
Select Add role.
Type a Role name, and a Description.
Select Next for Permissions.
For read permissions, in View Data, select Security Operations.
For write permissions, select Manage security settings in Security Center.
Select Next.
In Assigned user groups, select the user groups from the list to assign to this role.
Select Submit.
Summary of RBAC roles and permissions for site security
For Unified RBAC:
| Write permissions | Read permissions |
|---|---|
| Defender permissions: Core security settings (manage) under Authorization and Settings and scoped to all device groups. Entra ID roles: Global Administrator, Security Administrator, Security Operator and scoped to all device groups. |
Write roles (including roles that are non-scoped to all device groups). Defender permissions: Security data basics (under Security Operations). Entra ID roles: Global Reader, Security Reader. |
For Microsoft Defender for Endpoint XDR RBAC (version 2):
| Write permissions | Read permissions |
|---|---|
| Defender for Endpoint roles: Manage security settings in Security Center and scoped to all device groups. Entra ID roles: Global Administrator, Security Administrator. |
Write roles (including roles that are non-scoped to all device groups). Defender for Endpoint roles: View data - Security operations (read). Entra ID roles: Global Reader, Security Reader. |
Next steps
Once you have set up the RBAC roles and permissions, set up a site so that Microsoft Defender for IoT can begin sending data to the Defender portal.