Microsoft Defender for Endpoint

Manage portal access using role-based access control

4 September 2026Doc update+3 / −6 lines

In brief

The page removes the note about the Microsoft Defender 365 Unified RBAC preview and clarifies that Microsoft Entra roles can grant Defender for Endpoint permissions.

What Defender admins need to know

Administrators should use the updated guidance when reviewing permissions before enabling RBAC.

Summaries are generated from the documentation change itself.

Documentation change

View full page diff

View on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

Manage portal access using role-based access control

Note
If you are running the Microsoft Defender XDR preview program, you can now experience the new Microsoft Defender 365 Unified role-based access control (RBAC) model. For more information, see Microsoft Defender 365 Unified role-based access control (RBAC).
[!IMPORTANT] Starting February 16, 2025, new Microsoft Defender for Endpoint customers will only have access to the Unified Role-Based Access Control (URBAC). Existing customers keep their current roles and permissions. For more information, see URBAC Unified Role-Based Access Control (URBAC) for Microsoft Defender for Endpoint
Important
Starting February 16, 2025, new Microsoft Defender for Endpoint customers will only have access to the Unified Role-Based Access Control (URBAC). Existing customers keep their current roles and permissions. For more information, see URBAC Unified Role-Based Access Control (URBAC) for Microsoft Defender for Endpoint

Before you begin

Before using RBAC, it's important that you understand ~~the~~which Microsoft Entra roles ~~that~~ can grant Defender for Endpoint permissions and the consequences of turning on RBAC.

Warning
Before enabling RBAC, it's important that you have an appropriate role, such as Security Administrator assigned in Microsoft Entra ID, and that you have your Microsoft Entra groups ready to reduce the risk of being locked out of the Microsoft Defender portal.

@@ -9,18 +9,15 @@ ms.collection: - m365-security - tier2 ms.topic: how-to-ms.date: 06/17/2026+ms.date: 07/28/2026 appliesto:   - Microsoft Defender for Endpoint Plan 1   - Microsoft Defender for Endpoint Plan 2-ms.custom: sfi-ga-nochange, msecd-doc-authoring-1014+ms.custom: sfi-ga-nochange, msecd-doc-authoring-1016  ai-usage: ai-assisted --- # Manage portal access using role-based access control-> [!NOTE]-> If you are running the Microsoft Defender XDR preview program, you can now experience the new Microsoft Defender 365 Unified role-based access control (RBAC) model. For more information, see [Microsoft Defender 365 Unified role-based access control (RBAC)](/defender-xdr/manage-rbac).- > [!IMPORTANT] > Starting February 16, 2025, new Microsoft Defender for Endpoint customers will only have access to the Unified Role-Based Access Control (URBAC). > Existing customers keep their current roles and permissions. For more information, see URBAC [Unified Role-Based Access Control (URBAC) for Microsoft Defender for Endpoint](/defender-xdr/manage-rbac)@@ -57,7 +54,7 @@ To implement role-based access, you need to define admin roles, assign correspon  ## Before you begin -Before using RBAC, it's important that you understand the roles that can grant permissions and the consequences of turning on RBAC.+Before using RBAC, it's important that you understand which Microsoft Entra roles can grant Defender for Endpoint permissions and the consequences of turning on RBAC.  > [!WARNING] > Before enabling RBAC, it's important that you have an appropriate role, such as Security Administrator assigned in Microsoft Entra ID, and that you have your Microsoft Entra groups ready to reduce the risk of being locked out of the Microsoft Defender portal.