A step-by-step walkthrough of activating the Unified Role-Based Access Control model in Microsoft Defender XDR and creating granular custom roles for your security team.
What Is Unified RBAC in Microsoft Defender XDR?
Microsoft Defender XDR brings together threat protection, detection, and response across endpoints, email, identities, applications, and data — all within a single portal. Managing who can see what, and do what, within that environment is where Unified Role-Based Access Control (RBAC) comes in.
The Unified RBAC model provides a single, centralised permissions management experience inside the Microsoft Defender portal. Rather than juggling separate permission models for Defender for Endpoint, Defender for Office 365, Defender for Identity, and others, Unified RBAC brings them together under one roof — giving administrators granular control over user permissions across every supported workload from one place.
Important: From 16 February 2025, the Unified RBAC model became the default permissions model for all new Microsoft Defender for Endpoint tenants. New tenants can no longer export roles from the legacy model. Existing tenants with roles configured prior to that date retain their current configuration until you choose to migrate.
Before You Begin — Prerequisites
You’ll need the right permissions before you can activate or configure Unified RBAC. Specifically, you must hold at least the Security Administrator role in Microsoft Entra ID to perform the following:
- Access Permissions & Roles: Gain initial access to the Permissions and Roles section in the Microsoft Defender portal.
- Manage Roles: Create, edit, and manage roles and permissions in Microsoft Defender XDR Unified RBAC.
- Delegate Role Management: Create a custom role with the Authorisation permission so non-global admins can manage roles.
Key Consideration: Once workloads are activated, any previously custom-managed permissions for those workloads are replaced by the Unified RBAC model.
Step 1 — Activating Unified RBAC
To get started, navigate to the Microsoft Defender portal at security.microsoft.com or defender.microsoft.com.
1. Permissions Settings: There are two routes to reach the permissions setting:
- Option A — Via Settings: In the left-hand navigation pane, go to System → Settings → Microsoft Defender XDR. Under the General section, find Permissions and Roles.
- Option B — Via Permissions: Select Permissions in the navigation pane, then select Roles under Microsoft Defender XDR. From the roles page you’ll see an Activate workloads banner at the top.
2. Select Your Workloads
Choose which workloads you want to activate Unified RBAC for. Options include: Defender for Endpoint, Defender for Office 365 (Email & collaboration), Defender for Identity, Defender Vulnerability Management, and Defender for Cloud Apps. You can activate some or all.
3. Confirm Activation
Review the warning that activating a workload means any previously assigned custom permissions for that workload will no longer grant access via the old model. Once confirmed, the Unified RBAC model takes effect immediately for selected workloads.
Heads up: Activating a workload is a significant change. Once switched, the old permission model for that workload is replaced entirely. Make sure you have your custom roles planned and ready before activating, so users don’t lose access unexpectedly.
Step 2 — Creating Custom Roles
Once Unified RBAC is active, you can create custom roles tailored to the specific responsibilities of your security team. The role creation wizard walks you through three stages: Basics, Permissions, and Assignments.
Getting to the Role Creation Wizard
- Go to Permissions → Roles: In the Defender portal, navigate to Permissions → Microsoft Defender XDR → Roles. Here you’ll see any existing or imported roles.
- Create a Custom Role: Click Create custom role. Enter a role name and an optional description — for example, “Junior SOC Analyst” — then click Next.
- Configure Permissions: Select permissions from the available permission groups. You can choose pre-set permission bundles or go granular with custom permissions for each area.
- Create an Assignment: Assign the role to specific users, security groups, or data sources. You can create multiple assignments under the same role — for example, one assignment for all data sources, and another scoped to a specific team.
- Review and Submit: Review the role and assignment details, then click Submit to create the role. It takes effect immediately for activated workloads.
Understanding the Permission Groups
When building custom roles, permissions are organised into three main groups. You can mix and match across these groups, or select custom permissions within each:
| Permission Group | What It Covers | Example Use |
|---|---|---|
| Security Operations | Incident management, alerts, email & collaboration, raw data access, live response | SOC Analyst responding to alerts and managing incidents |
| Security Posture | Vulnerability management, Secure Score, exposure management, security recommendations | Vuln Analyst managing patching and risk prioritisation |
| Authorization & Settings | Role management, system settings, configuration access | Admin managing the Unified RBAC model itself |
A Practical Example — SOC Analyst Tiers
A common pattern for security teams is to create tiered roles that reflect seniority and responsibility. Here’s how you might structure that using Unified RBAC:
- Junior SOC Analyst: Read-only access to alerts, incidents, email & collaboration data. No ability to take action or access raw data.
- Mid-level SOC Analyst: Can manage alerts, respond to incidents, and access email message data. Limited raw data access.
- Senior SOC Analyst: Full security operations permissions including live response, raw data access, and vulnerability management.
Tip: You can create as many assignments as needed under the same role. For example, a Senior Analyst role could have one assignment scoped to all data sources, and a separate assignment restricted to a specific endpoint group — all within the same role definition.
Further Resources
- Microsoft Defender XDR Unified RBAC Overview (Microsoft Learn)
- Activate Microsoft Defender XDR Unified RBAC (Microsoft Learn)
- Create Custom Roles with Microsoft Defender Unified RBAC (Microsoft Learn)
- Permissions Reference — All Available Permissions in Unified RBAC (Microsoft Learn)
- What’s New in Microsoft Defender XDR Unified RBAC (Microsoft Learn)