Daily Defender News
Aboutmerill.net
Microsoft Defender for Endpoint
Endpoint protection

Assign Microsoft Defender for Endpoint basic permissions

4 September 2026Feature update+41 / −52 lines

In brief

The article now states that basic permissions are for existing Defender for Endpoint customers, with full access assigned through Security Administrator and read-only access through Security Reader. It also adds Microsoft Graph PowerShell role and delegated-permission prerequisites and notes that new customers use unified RBAC.

What Defender admins need to know

Administrators should verify their organization still uses basic permissions and meet the updated role and Graph connection requirements when assigning access. No general action or deadline is stated.

Summaries are generated from the documentation change itself.

Documentation change

View full page diffView on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

UseAssign basic permissions tofor Microsoft Defender for Endpoint portal access the portal

This article explains how to set up basicBasic permissions management in thegives existing Microsoft Defender portal, including how to assignfor Endpoint customers two portal access levels: full access or read-only access usingaccess. Use Microsoft Graph PowerShell. If you wantPowerShell to use basic permissions managementassign the Security Administrator role for the Microsoft Defender portal, keep in mind that permissions are set to either full access or read only.the Security Reader role for read-only access. For more granular control over permissions, use role-based access control.

Assign user access using Microsoft Graph PowerShellPrerequisites

You can assign users with one of the following levels of permissions:

  • Full access (Read and Write)
  • Read-only access

Before you begin

Complete the followingthese prerequisites before you assign user access:

  • Confirm that your organization still uses basic permissions management. If your organization switched to RBAC, you can't switch back to basic permissions.
  • Install Microsoft Graph PowerShell.
  • Use an account assigned the Privileged Role Administrator role or a custom role with the required role-management permissions. Privileged Role Administrator is the least-privileged Microsoft Entra built-in role supported for this operation.
  • Connect to Microsoft Graph PowerShell.by using Connect-MgGraph with the delegated RoleManagement.ReadWrite.Directory and User.ReadBasic.All permissions. For more information, see, How to install Microsoft Graph PowerShellauthentication options, see Microsoft Graph PowerShell authentication commands.

  • Connect to your Microsoft Entra ID. For more information, see Connect-MgGraph.

    You don't need to run PowerShell as a local Windows administrator to assign Microsoft Entra roles through Microsoft Graph.

    Understand the basic access levels

    Basic permissions management provides these access levels:

    • Full access: Users with full access can logsign in, view all system information andinformation, resolve alerts, submit files for deep analysis, and download the onboarding package. Assigning full access rights requires addingAssign the users to a role, such as Security Administrator, using Microsoft Entra built-in roles.Security Administrator role to grant full access.

    • Read-only access: Users with read-only access can log in,sign in and view all alerts,alerts and related information.

      They will not be able tocan't change alert states, submit files for deep analysisanalysis, or perform any state other state-changing operations.

      Assigning read-only access rights requires adding Assign the users to the "Security Reader" Microsoft Entra built-in role.Security Reader role to grant read-only access.

Assign user access using Microsoft Graph PowerShell

UseAssign the following stepsappropriate Microsoft Entra role to assign security roles:each user who needs access to Defender for Endpoint.

  • Assign full access

    For readReplace [email protected] with the user principal name of the account that needs full access, and write access, assign users to the security administrator role by usingthen run the following command: 

    $Role = Get-New-MgDirectoryRoleMemberByRef -DirectoryRoleId (Get-MgDirectoryRole -Filter "DisplayName eq 'Security Administrator'"
$UserId = (Get-MgUser -UserId "[email protected]").Id $DirObject = @{
  "@odata.id" =-OdataId "https://graph.microsoft.com/v1.0/directoryObjects/$UserId((Get-MgUser -UserId '[email protected]').Id)"
}

New-MgDirectoryRoleMemberByRef -DirectoryRoleId $Role.Id -BodyParameter $DirObject

  • For

    Assign read-only access

    Replace [email protected] with the user principal name of the account that needs read-only access, assign users to the security reader role by usingand then run the following command: 

    $Role = Get-New-MgDirectoryRoleMemberByRef -DirectoryRoleId (Get-MgDirectoryRole -Filter "DisplayName eq 'Security Reader'"
$UserId = (Get-MgUser -UserId "[email protected]").Id $DirObject = @{
  "@odata.id" =-OdataId "https://graph.microsoft.com/v1.0/directoryObjects/$UserId((Get-MgUser -UserId '[email protected]').Id)"
}

New-MgDirectoryRoleMemberByRef -DirectoryRoleId $Role.Id -BodyParameter $DirObject

For more information, see Add or remove group members using Microsoft Entra ID.

Related articlescontent