Microsoft Security Exposure Management

Defender CLI setup for agentic code security

4 September 2026Feature updateAction required+5 / −3 lines

In brief

The documentation adds a prerequisite requiring accounts to have at least one listed permission before running Defender CLI commands and updates the Defender.InteractiveLogin scope identifier.

What Defender admins need to know

Ensure affected accounts have the required permission and update authentication configuration to use the new scope identifier.

Summaries are generated from the documentation change itself.

Documentation change

View full page diff

View on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

Prerequisites

Before you can run the Defender CLI commands, make sure your account has been assigned at least one of the following permissions:

At least Security Administrator role in Microsoft Entra ID.
Required permissions assigned in Microsoft Defender unified RBAC. For more information, see Assign permissions to users using Defender RBAC.

az login \
  --tenant <DEFENDER_DFD_TENANT_ID> \
  --scope b1a78a13-a596-4366-b37d-406048fa4a23/c2fd607e-fe6e-41bd-ae58-08e2f24014aa/Defender.InteractiveLogin \
  --allow-no-subscriptions \
  --use-device-code

Install and run Defender CLI
CI/CD example for Defender CLI
~~Set up agentic code security~~ \ No newline at end of file
Set up agentic code security

@@ -2,7 +2,7 @@ title: Defender CLI setup for agentic code security description: Set up Defender CLI authentication to run agentic code scans locally or in CI/CD pipelines. ms.topic: how-to-ms.date: 07/08/2026+ms.date: 08/13/2026 ai-usage: ai-assisted --- @@ -124,6 +124,8 @@ Use this approach to let users authenticate with their Defender credentials for  ### Prerequisites +Before you can run the Defender CLI commands, make sure your account has been assigned at least one of the following permissions:+ - At least **Security Administrator** role in Microsoft Entra ID. - Required permissions assigned in Microsoft Defender unified RBAC. For more information, see [Assign permissions to users using Defender RBAC](ai-code-security-onboarding.md#assign-permissions-to-users-using-defender-rbac). @@ -142,7 +144,7 @@ Run the following command to start a device code sign-in flow for Defender inter ```bash az login \   --tenant <DEFENDER_DFD_TENANT_ID> \-  --scope b1a78a13-a596-4366-b37d-406048fa4a23/Defender.InteractiveLogin \+  --scope c2fd607e-fe6e-41bd-ae58-08e2f24014aa/Defender.InteractiveLogin \   --allow-no-subscriptions \   --use-device-code ```@@ -158,4 +160,4 @@ az login \  - [Install and run Defender CLI](defender-cli.md) - [CI/CD example for Defender CLI](defender-cli-cicd.md)-- [Set up agentic code security](ai-code-security-onboarding.md)\ No newline at end of file+- [Set up agentic code security](ai-code-security-onboarding.md)