Compare Rbac Roles

@@ -11,7 +11,7 @@ ms.collection: ms.custom:   - sfi-ga-nochange ms.topic: concept-article-ms.date: 07/10/2026+ms.date: 07/30/2026 ms.reviewer: appliesto: - Microsoft Defender for Endpoint Plan 2@@ -78,46 +78,77 @@ Use the following table to learn how your existing permissions for Microsoft Def  ## Microsoft Defender for Office 365 -Use the following tables to learn how your existing email amd collaboration and protection-related Exchange Online permissions for Defender for Office 365 map to the new Microsoft Defender unified RBAC permissions:+Use the following tables to learn how your existing email and collaboration permissions and protection-related Exchange Online permissions for Defender for Office 365 map to Microsoft Defender unified RBAC permissions:  - [Email and collaboration permissions mapping](#email--collaboration-permissions-mapping) - [Exchange Online permissions mapping](#exchange-online-permissions-mapping) +> [!NOTE]+> When you activate Defender unified RBAC for the Email & collaboration workload, only source roles and role groups that are actively assigned to at least one user are imported. Built-in roles and role groups without active user assignments aren't imported.+ ### Email & collaboration permissions mapping  You configured Email & collaboration permissions in the Defender portal at <https://security.microsoft.com/emailandcollabpermissions>. -|Email & collaboration permission|Type|Microsoft Defender unified RBAC permission|-|---|---|---|-|Global Reader|Role group|Security operations \ Security data \ Security data basics (read) <br/> Security operations \ Raw data (Email & collaboration) \ Email & collaboration metadata (read) <br/> Security operations \ Security data \ Response (manage) <br/> Authorization and settings \ Security settings \ Core security settings (read) <br/> Authorization and settings \ System setting (read)<br/>Security operations \ Raw data (Email & collaboration) \ Email & collaboration content: Quarantine Emails (read)|-|Organization Management|Role group|Security operations \ Security data \ Security data basics (read) <br/> Security operations \ Security data \ Alerts (manage) <br/> Security operations \ Raw data (Email & collaboration) \ Email & collaboration metadata (read) <br/> Security operations \ Security data \ Response (manage) <br/> Security operations \ Security data \ Email advanced actions (manage) <br/> Security operations \ Security data \ Email quarantine (manage) <br/> Authorization and settings \ Authorization (Read and manage) <br/> Authorization and settings \ Security setting (All permissions) <br/> Authorization and settings \ System settings (Read and manage)<br/>Security operations \ Raw data (Email & collaboration) \ Email & collaboration content: Quarantine Emails (read)|-|Security Administrator|Role group|Security operations \ Security data \ Security data basics (read) <br/> Security operations \ Security data \ Alerts (manage) <br/> Security operations \ Raw data (Email & collaboration) \ Email & collaboration metadata (read) <br/> Security operations \ Security data \ Response (manage) <br/> Security operations \ Security data \ Email quarantine (manage) <br/> Authorization and settings \ Authorization (read) <br/> Authorization and settings \ Security setting (All permissions) <br/> Authorization and settings \ System settings (Read and manage)<br/>Security operations \ Raw data (Email & collaboration) \ Email & collaboration content: Quarantine Emails (read)|-|Security Reader|Role group|Security operations \ Security data \Security data basics (read) <br/> Security operations \ Raw data (Email & collaboration) \ Email & collaboration metadata (read) <br/> Security operations \ Security data \ Response (manage) <br/> Authorization and settings \ Security settings \ Core security settings (read) <br/> Authorization and settings \ System setting (read) <br/>Security operations \ Raw data (Email & collaboration) \ Email & collaboration content: Quarantine Emails (read)|-|Audit Logs|Role|Security operations \ Security data \ Security data basics (read)|-|Manage Alerts|Role|Security operations \ Security data \ Security data basics (read) <br/> Security operations \ Security data \ Alerts (manage)|-|Preview|Role|Security operations\ Security operations \ Raw data (Email & collaboration) \ Email & collaboration content: All Emails (read)|-|Quarantine|Role|Security operations \ Security data \ Email quarantine (manage) <br/> Security operations \ Raw data (Email & collaboration) \ Email & collaboration content: Quarantine Emails (read)|-|Role Management|Role|Authorization and settings \ Authorization (Read and manage)|-|Search and Purge|Role|Security operations \ Security data \ Email advanced actions (manage)|-|View-Only Manage Alerts|Role|Security operations \ Security data \ Security data basics (read)|-|View-Only Recipients|Role|Security operations \ Security data \ Security data basics (read) <br/> Security operations \ Raw data (Email & collaboration) \ Email & collaboration metadata (read)|-|View-only Audit Logs|Role|Security operations \ Security data \ Security data basics (read)|+| Email & collaboration permission | Type | Microsoft Defender unified RBAC permission |+| --- | --- | --- |+| Global Reader | Role group | Security operations \ Security data \ Security data basics (read)<br>Security operations \ Raw data (Email & collaboration) \ Email & collaboration metadata (read)<br>Security operations \ Security data \ Response (manage)<br>Authorization and settings \ Security settings \ Core security settings (read)<br>Authorization and settings \ System setting (read)<br>Security operations \ Raw data (Email & collaboration) \ Email & collaboration content: Quarantine Emails (read) |+| Organization Management | Role group | Security operations \ Security data \ Security data basics (read)<br>Security operations \ Security data \ Alerts (manage)<br>Security operations \ Raw data (Email & collaboration) \ Email & collaboration metadata (read)<br>Security operations \ Security data \ Response (manage)<br>Security operations \ Security data \ Email advanced actions (manage)<br>Security operations \ Security data \ Email quarantine (manage)<br>Authorization and settings \ Authorization (Read and manage)<br>Authorization and settings \ Security setting (All permissions)<br>Authorization and settings \ System settings (Read and manage)<br>Security operations \ Raw data (Email & collaboration) \ Email & collaboration content: Quarantine Emails (read) |+| Security Administrator | Role group | Security operations \ Security data \ Security data basics (read)<br>Security operations \ Security data \ Alerts (manage)<br>Security operations \ Raw data (Email & collaboration) \ Email & collaboration metadata (read)<br>Security operations \ Security data \ Response (manage)<br>Security operations \ Security data \ Email quarantine (manage)<br>Authorization and settings \ Authorization (read)<br>Authorization and settings \ Security setting (All permissions)<br>Authorization and settings \ System settings (Read and manage)<br>Security operations \ Raw data (Email & collaboration) \ Email & collaboration content: Quarantine Emails (read) |+| Security Reader | Role group | Security operations \ Security data \ Security data basics (read)<br>Security operations \ Raw data (Email & collaboration) \ Email & collaboration metadata (read)<br>Security operations \ Security data \ Response (manage)<br>Authorization and settings \ Security settings \ Core security settings (read)<br>Authorization and settings \ System setting (read)<br>Security operations \ Raw data (Email & collaboration) \ Email & collaboration content: Quarantine Emails (read) |+| Security Operator | Role group | Security operations \ Security data \ Security data basics (read)<br>Security operations \ Security data \ Alerts (manage)<br>Security operations \ Raw data (Email & collaboration) \ Email & collaboration metadata (read)<br>Security operations \ Security data \ Response (manage)<br>Authorization and settings \ Security settings \ Core security settings (read)<br>Authorization and settings \ System setting (read)<br>Security operations \ Raw data (Email & collaboration) \ Email & collaboration content: Quarantine Emails (read) |+| Audit Manager | Role group | Security operations \ Security data \ Security data basics (read) |+| Audit Reader | Role group | Security operations \ Security data \ Security data basics (read) |+| Quarantine Administrator | Role group | Security operations \ Security data \ Email quarantine (manage)<br>Security operations \ Raw data (Email & collaboration) \ Email & collaboration content: Quarantine Emails (read) |+| Security Reader | Role | Security operations \ Security data \ Security data basics (read)<br>Security operations \ Raw data (Email & collaboration) \ Email & collaboration metadata (read)<br>Security operations \ Security data \ Response (manage)<br>Authorization and settings \ Security settings (Read-only)<br>Authorization and settings \ System setting (read)<br>Security operations \ Raw data (Email & collaboration) \ Email & collaboration content: Quarantine Emails (read) |+| Security Administrator | Role | Security operations \ Security data \ Security data basics (read)<br>Security operations \ Security data \ Alerts (manage)<br>Security operations \ Raw data (Email & collaboration) \ Email & collaboration metadata (read)<br>Security operations \ Security data \ Response (manage)<br>Security operations \ Security data \ Email quarantine (manage)<br>Authorization and settings \ Authorization (read)<br>Authorization and settings \ Security setting (All permissions)<br>Authorization and settings \ System settings (Read and manage)<br>Security operations \ Raw data (Email & collaboration) \ Email & collaboration content: Quarantine Emails (read) |+| Audit Logs | Role | Security operations \ Security data \ Security data basics (read) |+| Manage Alerts | Role | Security operations \ Security data \ Security data basics (read)<br>Security operations \ Security data \ Alerts (manage) |+| Preview | Role | Security operations \ Raw data (Email & collaboration) \ Email & collaboration content: All Emails (read) |+| Quarantine | Role | Security operations \ Security data \ Email quarantine (manage)<br>Security operations \ Raw data (Email & collaboration) \ Email & collaboration content: Quarantine Emails (read) |+| Role Management | Role | Authorization and settings \ Authorization (Read and manage) |+| Search and Purge | Role | Security operations \ Security data \ Email advanced actions (manage) |+| View-Only Manage Alerts | Role | Security operations \ Security data \ Security data basics (read) |+| View-Only Recipients | Role | Security operations \ Security data \ Security data basics (read)<br>Security operations \ Raw data (Email & collaboration) \ Email & collaboration metadata (read) |+| View-only Audit Logs | Role | Security operations \ Security data \ Security data basics (read) |+| Compliance Administrator | Role | Security operations \ Security data \ Security data basics (read)<br>Security operations \ Security data \ Alerts (manage) |+| DLP Compliance Management | Role | Security operations \ Security data \ Security data basics (read)<br>Security operations \ Security data \ Alerts (manage) |+| Organization Configuration | Role | Security operations \ Security data \ Security data basics (read)<br>Security operations \ Security data \ Alerts (manage) |+| Record Management | Role | Security operations \ Security data \ Security data basics (read)<br>Security operations \ Security data \ Alerts (manage) |+| Retention Management | Role | Security operations \ Security data \ Security data basics (read)<br>Security operations \ Security data \ Alerts (manage) |+| View-Only DLP Compliance Management | Role | Security operations \ Security data \ Security data basics (read) |+| View-Only Record Management | Role | Security operations \ Security data \ Security data basics (read) |+| View-Only Retention Management | Role | Security operations \ Security data \ Security data basics (read) |++To identify which built-in Microsoft Purview role groups include a given role, see [Roles and role groups in Microsoft Defender for Office 365 and Microsoft Purview](/defender-office-365/scc-permissions#role-groups-in-microsoft-defender-for-office-365-and-microsoft-purview).++> [!NOTE]+> Permissions are mapped at the individual-role level. When an imported assignment is based on a role group, the resulting Microsoft Defender unified RBAC role receives the union of the mapped permissions for the roles assigned to that role group. Depending on how the source permission was assigned, you might see either a role name or a role-group name in the imported Microsoft Defender unified RBAC view.+>+> As a result, Microsoft Purview or custom role groups that aren't listed explicitly in the table can still appear in the imported view if they contain mapped roles. To determine the effective permissions for an unlisted role group, identify its assigned roles using the preceding Microsoft Purview documentation, and combine the corresponding role mappings in the table.+>+> For example, the **Preview** role is assigned by default to the following Microsoft Purview role groups: **Data Investigator**, **eDiscovery Manager**, **Privacy Management**, **Privacy Management Administrators**, **Privacy Management Analysts**, **Privacy Management Contributors**, **Privacy Management Investigators**, **Privacy Management Viewers**, **Subject Rights Request Administrators**, and **Subject Rights Request Approvers**. These role groups can therefore appear in the imported view with the mapped Preview permission. Data Investigator also contains **Search and Purge**, so it additionally receives the mapped Email advanced actions permission.+>+> The **Preview** role maps to **Security operations \ Raw data (Email & collaboration) \ Email & collaboration content: All Emails (read)**. In the Defender unified RBAC experience, selecting this permission—whether through role import or manual role configuration—also selects **Security operations \ Security data \ Security data basics (read)** and **Security operations \ Raw data (Email & collaboration) \ Email & collaboration metadata (read)** as prerequisites. An administrator can review and update the resulting role and its assignments in the Defender unified RBAC role experience as appropriate.  ### Exchange Online permissions mapping  You configured protection-related Exchange Online permissions in the Exchange admin center (EAC) at <https://admin.exchange.microsoft.com/#/adminRoles>. -|Exchange Online permission|Type|Microsoft Defender unified RBAC permission|-|---|---|---|-|Hygiene Management|Role group|Security operations \ Security data \ Email quarantine (manage) <br/> Authorization and settings \ Security settings \ Core security settings (manage) <br/> Authorization and settings \ Security settings \ Detection tuning (manage)|-|Organization Management|Role group|Security operations \ Raw data (email & collaboration) \ Email & collaboration metadata (read) <br/> Authorization and settings \ Security settings \ Core security settings (manage) <br/> Authorization and settings \ Security settings \ Detection tuning (manage) <br/> Authorization and settings \ System settings (Read and manage)|-|Security Administrator|Role group|Authorization and settings \ Security settings \ Detection tuning (manage) <br/> Authorization and settings \ System settings (Read and manage)|-|View-Only Organization Management|Role group|Authorization and settings \ Security settings (Read-only) <br/> Authorization and settings \ System settings (Read-only)|-|Tenant AllowBlockList Manager|Role|Authorization and settings \ Security settings \ Detection tuning (manage)|-|View-only Recipients|Role|Security operations \ Raw data (email & collaboration) \ Email & collaboration metadata (read)|-|Security Reader|Role group|Authorization and settings \ Security settings \ Core security settings (read)|-|View-Only Configuration|Role|Authorization and settings \ Security settings \ Core security settings (read)|-|Security Operator|Role group|Authorization and settings \ Security settings \ Detection tuning (manage)|+> [!NOTE]+> In the **Activate workloads** experience in the Defender portal, the role groups and roles in the following table are activated under the workload named **Exchange Online permissions**.++| Exchange Online permission | Type | Microsoft Defender unified RBAC permission |+| --- | --- | --- |+| Hygiene Management | Role group | Security operations \ Security data \ Email quarantine (manage)<br>Authorization and settings \ Security settings \ Core security settings (manage)<br>Authorization and settings \ Security settings \ Detection tuning (manage) |+| Organization Management | Role group | Security operations \ Raw data (email & collaboration) \ Email & collaboration metadata (read)<br>Authorization and settings \ Security settings \ Core security settings (manage)<br>Authorization and settings \ Security settings \ Detection tuning (manage)<br>Authorization and settings \ System settings (Read and manage) |+| Security Administrator | Role group | Authorization and settings \ Security settings \ Detection tuning (manage)<br>Authorization and settings \ System settings (Read and manage) |+| View-Only Organization Management | Role group | Authorization and settings \ Security settings (Read-only)<br>Authorization and settings \ System settings (Read-only) |+| Tenant AllowBlockList Manager | Role | Authorization and settings \ Security settings \ Detection tuning (manage) |+| View-only Recipients | Role | Security operations \ Raw data (email & collaboration) \ Email & collaboration metadata (read) |+| Security Reader | Role group | Authorization and settings \ Security settings \ Core security settings (read) |+| View-Only Configuration | Role | Authorization and settings \ Security settings \ Core security settings (read) |+| Security Operator | Role group | Authorization and settings \ Security settings \ Detection tuning (manage) |  <a name='microsoft-defender-for-identity'></a> @@ -186,10 +217,10 @@ Use the following table to learn how your existing permissions for Microsoft Sen  |Sentinel role|URBAC role|Defender unified RBAC permission| |---|---|-----|-|Sentinel Reader|Defender Unified RBAC Reader|Security operations \ Security data \ Security data basic (read)|-|Sentinel Responder|Defender Unified RBAC Responder|Security operations \ Security data \ Security data basic (read) </br>Security operations \ Security data \ Alerts (manage) </br>Security operations \ Security data \ Response (manage)|-|Sentinel Contributor|Defender Unified RBAC Contributor and Responder|Security operations \ Security data \ Security data basic (read) </br>Security operations \ Security data \ Alerts (manage)  </br>Security operations \ Security data \ Response (manage) </br>Authorization and settings \ Detection tuning (manage)|-|N/A|Defender Unified RBAC Scoped Reader|Security operations \ Security data \ Security data basic (read) <br/>Applies only to role assignments with Sentinel Scope applied|+|Sentinel Reader|Defender Unified RBAC Reader|Security operations \ Security data \ Security data basics (read)|+|Sentinel Responder|Defender Unified RBAC Responder|Security operations \ Security data \ Security data basics (read) </br>Security operations \ Security data \ Alerts (manage) </br>Security operations \ Security data \ Response (manage)|+|Sentinel Contributor|Defender Unified RBAC Contributor and Responder|Security operations \ Security data \ Security data basics (read) </br>Security operations \ Security data \ Alerts (manage)  </br>Security operations \ Security data \ Response (manage) </br>Authorization and settings \ Detection tuning (manage)|+|N/A|Defender Unified RBAC Scoped Reader|Security operations \ Security data \ Security data basics (read) <br/>Applies only to role assignments with Sentinel Scope applied| |N/A|Defender Unified RBAC Data Manager|Data operations \ Data management \ Data (manage)|  The following roles aren't available in unified RBAC and must be managed in the Azure portal: Microsoft Sentinel Playbook Operator, Automation Contributor, and Workbook Contributor.@@ -214,7 +245,7 @@ If some users need only read access to Microsoft Sentinel SIEM raw data, they ca | Security Engineer | Security Administrator Unified RBAC role | Microsoft Defender portal | Monitor security-related policies across Microsoft Defender services<br />Manage security threats and alerts<br />View reports<br /><br />List of URBAC permissions equivalent for Security Administrator Entra ID role are listed on this link:<br />/defender-xdr/compare-rbac-roles#microsoft-entra-global-roles-access | | Security Architect | Microsoft Sentinel Contributor | Microsoft Sentinel's Resource Group | View data, incidents, workbooks, and other Microsoft Sentinel resources. Manage incidents (assign, dismiss, etc.). Create and edit workbooks, analytics rules, and other Microsoft Sentinel resources. | | Security Architect | User Access Administrator | Microsoft Sentinel's Resource Group | This is privileged role! This permission is needed to onboard Microsoft Sentinel SIEM to Microsoft Defender portal. |-| Security Architect | Security Administrator | Entara ID Tenant level | This is a privileged role! Users with this role have permissions to manage security-related features in the Microsoft 365 Defender portal, Microsoft Entra ID Protection, Microsoft Entra Authentication, Azure Information Protection, and Microsoft Purview compliance portal.<br /><br />This permission is needed to onboard Microsoft Sentinel SIEM to Microsoft Defender portal, offboard the workspace, or change primary/secondary workspace. |+| Security Architect | Security Administrator | Microsoft Entra ID tenant level | This is a privileged role! Users with this role have permissions to manage security-related features in the Microsoft 365 Defender portal, Microsoft Entra ID Protection, Microsoft Entra Authentication, Azure Information Protection, and Microsoft Purview compliance portal.<br /><br />This permission is needed to onboard Microsoft Sentinel SIEM to Microsoft Defender portal, offboard the workspace, or change primary/secondary workspace. |  <a name='azure-active-directory-global-roles-access'></a> @@ -226,12 +257,13 @@ Use this table to learn about the permissions assigned by default for each workl  |Microsoft Entra role|Microsoft Defender unified RBAC assigned permissions for all workloads|Microsoft Defender unified RBAC assigned permissions – workload specific| |---|---|---|-|Global administrator|Security operations \ Security data \ Security data basics (read) <br/> Security operations \ Security data \ Alerts (manage) <br/> Security operations \ Security data \ Response (manage) <br/> Security posture \ Posture management \ Exposure Management (read) <br/> Security posture \ Posture management \ Exposure Management (manage) <br/> Authorization and settings \ Authorization (Read and manage) <br/> Authorization and settings \ Security settings (All permissions) <br/> Authorization and settings \ System settings (Read and manage) |_**Defender for Endpoint and Defender Vulnerability Management permissions only permissions**_ <br/> Security operations \ Basic live response (manage) <br/> Security operations \ Advanced live response (manage) <br/> Security operations  \ Security data \ File collection (manage) <br/> Security posture \ Posture management \ Vulnerability management (read) <br/> Security posture \ Posture management \ Exception handling (manage) <br/> Security posture \ Posture management \ Remediation handling (manage) <br/> Security posture \ Posture management \ Application handling (manage) <br/> Security posture \ Posture management \ Security baseline assessment (manage) <br/> <br/> _**Defender for Office only permissions**_ <br/> Security operations \ Security data \ Email quarantine (manage) <br/> Security operations \ Security data \ Email advanced actions (manage) <br/> Security operations \ Raw data (Email & collaboration) \ Email & collaboration metadata (read)|+|Global administrator|Security operations \ Security data \ Security data basics (read) <br/> Security operations \ Security data \ Alerts (manage) <br/> Security operations \ Security data \ Response (manage) <br/> Security posture \ Posture management \ Exposure Management (read) <br/> Security posture \ Posture management \ Exposure Management (manage) <br/> Authorization and settings \ Authorization (Read and manage) <br/> Authorization and settings \ Security settings (All permissions) <br/> Authorization and settings \ System settings (Read and manage) |_**Defender for Endpoint and Defender Vulnerability Management permissions only permissions**_ <br/> Security operations \ Basic live response (manage) <br/> Security operations \ Advanced live response (manage) <br/> Security operations  \ Security data \ File collection (manage) <br/> Security posture \ Posture management \ Vulnerability management (read) <br/> Security posture \ Posture management \ Exception handling (manage) <br/> Security posture \ Posture management \ Remediation handling (manage) <br/> Security posture \ Posture management \ Application handling (manage) <br/> Security posture \ Posture management \ Security baseline assessment (manage) <br/> <br/> _**Defender for Office only permissions**_ <br/> Security operations \ Security data \ Email quarantine (manage) <br/> Security operations \ Security data \ Email advanced actions (manage) <br/> Security operations \ Raw data (Email & collaboration) \ Email & collaboration metadata (read) <br/> Security operations \ Raw data (Email & collaboration) \ Email & collaboration content: Quarantine Emails (read)| |Security administrator|Same as Global administrator|Same as Global administrator|-|Global reader|Security operations \ Security data \ Security data basics (read) <br/> Security posture \ Posture management \ Exposure Management (read) <br/>|_**Defender for Endpoint and Defender Vulnerability Management permissions only permissions**_ <br/> Security posture \ Posture management \ Vulnerability management (read) <br/> <br/> _**Defender for Office only permissions**_ <br/> Security operations \ Security data \ Response (manage) <br/> Security operations \ Raw data (Email & collaboration) \ Email & collaboration metadata (read) <br/> Authorization and settings \ Authorization (read) <br/><br/>_**Defender for Office and Defender for Identity only permissions**_ <br/> Authorization and settings \ Security settings \ Core security settings (read) <br/> Authorization and settings \ System settings (read)|-|Security reader|Security operations \ Security data \ Security data basics (read) <br/> Security posture \ Posture management \ Exposure Management (read) <br/>|_**Defender for Endpoint and Defender Vulnerability Management permissions only permissions**_ <br/> Security posture \ Posture management \ Vulnerability management (read) <br/> <br/> _**Defender for Office only permissions**_ <br/> Security operations \ Security data \ Response (manage) <br/> Security operations \ Raw data (Email & collaboration) \ Email & collaboration metadata (read) <br/><br/>_**Defender for Office and Defender for Identity only permissions**_ <br/> Authorization and settings \ Security settings \ Core security settings (read) <br/> Authorization and settings \ System settings (read)|-|Security operator|Security operations \ Security data \ Security data basics (read) <br/> Security posture \ Posture management \ Exposure Management (read) <br/> Security operations \ Security data \ Response (manage) <br/> Security posture \ Posture management \ Secure Score (read) <br/> Authorization and settings \ Security settings (All permissions)|_**Defender for Endpoint and Defender Vulnerability Management permissions only permissions**_<br/> Security operations  \ Security data \ Basic live response (manage) <br/> Security operations  \ Security data \ Advanced live response (manage) <br/> Security operations \ Security data \ File collection (manage) <br/> Security posture \ Posture management \ Vulnerability management (read) <br/> Security posture \ Posture management \ Exception handling (manage) <br/> Security posture \ Posture management \ Remediation handling (manage) <br/> <br/>_**Defender for Office only permissions**_ <br/> Security operations \ Raw data (Email & collaboration) \ Email & collaboration metadata (read) <br/> Authorization and settings \ System settings (Read and manage) <br/> <br/>_**Defender for Identity only permissions**_ <br/> Authorization and settings \ System settings (read)|-|Exchange Administrator|Security posture \ Posture management \ Exposure Management (read) <br/> Security posture \ Posture management \ Exposure Management (manage) |_**Defender for Office only permissions**_ <br/> Security operations \ Security data \ Security data basic (read) <br/> Security operations \ Raw data (Email & collaboration) \ Email & collaboration metadata (read) <br/> Authorization and settings \ System settings (Read and manage)|+|Global reader|Security operations \ Security data \ Security data basics (read) <br/> Security posture \ Posture management \ Exposure Management (read) <br/>|_**Defender for Endpoint and Defender Vulnerability Management permissions only permissions**_ <br/> Security posture \ Posture management \ Vulnerability management (read) <br/> <br/> _**Defender for Office only permissions**_ <br/> Security operations \ Security data \ Response (manage) <br/> Security operations \ Raw data (Email & collaboration) \ Email & collaboration metadata (read) <br/> Security operations \ Raw data (Email & collaboration) \ Email & collaboration content: Quarantine Emails (read) <br/> Authorization and settings \ Authorization (read) <br/><br/>_**Defender for Office and Defender for Identity only permissions**_ <br/> Authorization and settings \ Security settings \ Core security settings (read) <br/> Authorization and settings \ System settings (read)|+|Security reader|Security operations \ Security data \ Security data basics (read) <br/> Security posture \ Posture management \ Exposure Management (read) <br/>|_**Defender for Endpoint and Defender Vulnerability Management permissions only permissions**_ <br/> Security posture \ Posture management \ Vulnerability management (read) <br/> <br/> _**Defender for Office only permissions**_ <br/> Security operations \ Security data \ Response (manage) <br/> Security operations \ Raw data (Email & collaboration) \ Email & collaboration metadata (read) <br/> Security operations \ Raw data (Email & collaboration) \ Email & collaboration content: Quarantine Emails (read) <br/><br/>_**Defender for Office and Defender for Identity only permissions**_ <br/> Authorization and settings \ Security settings \ Core security settings (read) <br/> Authorization and settings \ System settings (read)|+|Security operator|Security operations \ Security data \ Security data basics (read) <br/> Security posture \ Posture management \ Exposure Management (read) <br/> Security operations \ Security data \ Response (manage) <br/> Security posture \ Posture management \ Secure Score (read) <br/> Authorization and settings \ Security settings (All permissions)|_**Defender for Endpoint and Defender Vulnerability Management permissions only permissions**_<br/> Security operations  \ Security data \ Basic live response (manage) <br/> Security operations  \ Security data \ Advanced live response (manage) <br/> Security operations \ Security data \ File collection (manage) <br/> Security posture \ Posture management \ Vulnerability management (read) <br/> Security posture \ Posture management \ Exception handling (manage) <br/> Security posture \ Posture management \ Remediation handling (manage) <br/> <br/>_**Defender for Office only permissions**_ <br/> Security operations \ Raw data (Email & collaboration) \ Email & collaboration metadata (read) <br/> Security operations \ Raw data (Email & collaboration) \ Email & collaboration content: Quarantine Emails (read) <br/> Authorization and settings \ System settings (Read and manage) <br/> <br/>_**Defender for Identity only permissions**_ <br/> Authorization and settings \ System settings (read)|+|SOC Identity Responder|Security operations \ Security data \ Security data basics (read) <br/> Security operations \ Security data \ Alerts (manage) <br/> Security operations \ Security data \ Response (manage)|not applicable|+|Exchange Administrator|Security posture \ Posture management \ Exposure Management (read) <br/> Security posture \ Posture management \ Exposure Management (manage) |_**Defender for Office only permissions**_ <br/> Security operations \ Security data \ Security data basics (read) <br/> Security operations \ Raw data (Email & collaboration) \ Email & collaboration metadata (read) <br/> Authorization and settings \ System settings (Read and manage)| |SharePoint Administrator|Security posture \ Posture management \ Exposure Management (read) <br/> Security posture \ Posture management \ Exposure Management (manage)|not applicable| |Service Support Administrator|Security posture \ Posture management \ Exposure Management (read) |not applicable| |User Administrator|Security posture \ Posture management \ Exposure Management (read) |not applicable|