Daily Defender News
Aboutmerill.net
Microsoft Defender XDR
General

Scoping

4 September 2026New feature+43 / −26 lines

In brief

The scoping guide now documents applying scope tags through Azure Monitor data collection rules (DCRs), including CI/CD workflows. It also updates prerequisites, requires Data Operations (Manage) and Alerts (Manage) for Table Management, and clarifies subscription requirements and rule timing.

What Defender admins need to know

Administrators managing schemas or ingestion transformations outside the Defender portal can use DCRs to apply scope tags. Review the updated permissions and prerequisites when configuring scoping.

Summaries are generated from the documentation change itself.

Documentation change

View full page diffView on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

Microsoft Sentinel scoping provides row-level role-based access control (RBAC), enabling granular, row-level access without requiring workspace separation. Microsoft Sentinel scoping allows multiple teams to operate securely within a shared Microsoft Sentinel environment while using consistent and reusable scope definitions across tables and experiences.

Configure scoping in the Microsoft Defender portal. Sentinel in the Azure portal (Ibiza) doesn't support scoping. Before you begin, make sure you meet the prerequisites for configuring scoping.

What is Microsoft Sentinel scoping?

  • Restrict access by scope: Limit user access to alerts, incidents, hunting queries, and data lake exploration based on their assigned scope

Scopes apply to Sentinel tables that support ingestion-time transformations.

  • Sentinel enabled in Unified RBAC: You must enable Microsoft Sentinel in URBAC before using this feature.
  • Required permissions for the person assigning scope and tagging tables:
    • Security Authorization (Manage) permission (URBAC) to create scopes and assignments
    • Data Operations (Manage) permissionand Alerts (Manage) permissions (URBAC) for Table Management
    • Subscription owner or assigned with the Microsoft.Insights/DataCollectionRules/Write permission to create Data Collection Rules (DCRs)

Step 1: Create a Sentinel scope

:::image type="content" source="./media/scoping/add-scope.png" alt-text="Screenshot of the Add Sentinel scope tab and dialog." lightbox="./media/scoping/add-scope.png":::

Step 2: Assign scope tags to users or groups

  1. Select Create custom role.

  2. Enter the role name and description, and select Next.

    :::image type="content" source="./media/scoping/set-up-basics.png" alt-text="Screenshot of dialog for creating name and description of a custom role." lightbox="./media/scoping/set-up-basics.png":::

  3. Assign the required permissions to the role and select Apply.

    :::image type="content" source="./media/scoping/assign-permissions.png" alt-text="Screenshot of dialog for assigning permissions to a custom role." lightbox="./media/scoping/assign-permissions.png":::

  4. In Assignments, enter a name and select:

    • Users or user groups (Microsoft Entra ID groups)

:::image type="content" source="./media/scoping/edit-scope.png" alt-text="Screenshot of assigning Sentinel scopes to a custom role." lightbox="./media/scoping/edit-scope.png":::

Step 3: Tag tables with scope

  • Only tables that support ingestion-time transformations can be tagged. Custom tables built on CLv1 aren't supported; CLv2 tables are supported.
  • XDR tables aren't supported, including extended retention of XDR tables into the lake.
  • You can only add transformations in the same Azure subscription that contains the target workspace.
  • You can only tag newly ingested data. Previously ingested data isn't included and can't be retroactively scoped.
  • The Log Analytics tables SecurityAlerts and SecurityIncidents don't automatically inherit scope from the raw tables that generated them, so scoped users can't access them by default. As a workaround, either:
    • Use the XDR AlertsInfo and AlertsEvidence tables, where scope is inherited automatically, or

  1. Select a table that supports ingestion-time transformations.

  2. Select Scope tag rule.

    :::image type="content" source="./media/scoping/scope-tag-rule.png" alt-text="Screenshot of the Scope tag rule tab." lightbox="./media/scoping/scope-tag-rule.png":::

  3. Enable the Allow use of scope tags for RBAC toggle.

  4. Enable the Scope tag rule toggle.

  5. Select the scope to apply to rows matching the expression.

  6. Save the rule.

You can only tag newly ingested data. Previously ingested data isn't included. After you save a scope tag rule, it can take up to an hour for that rule to take effect.

:::image type="content" source="./media/scoping/table-scope-tag-rule.png" alt-text="Screenshot of the table scope tag rule." lightbox="./media/scoping/table-scope-tag-rule.png":::

Manually tag data by using a DCR

If your organization manages table schemas and ingestion-time transformations outside the Microsoft Defender portal, you can apply scope tags directly in Azure Monitor. This option supports both direct configuration and automated deployment workflows, including CI/CD. Complete the table schema and DCR configuration before you enable scoped access for the table in Microsoft Sentinel.

  1. Add a custom column named SentinelScope_CF with the string data type to the table schema. For more information, see Manage tables in a Log Analytics workspace.

  2. Create or update a DCR for the table. Add a transformation that populates SentinelScope_CF with the Microsoft Sentinel scope values for each row. For guidance on selecting and configuring the DCR, see Configure your data transformation.

  3. In the Microsoft Defender portal, go to Microsoft Sentinel > Configuration > Tables.

  4. Select the table, and then select Scope tag rule.

  5. Set Control access with scope tags to On. Leave Rule status set to Off because the DCR applies the tags.

    :::image type="content" source="./media/scoping/control-access-scope-tags-toggle-cropped.png" alt-text="Screenshot of the Scope tagging pane showing Control access with scope tags set to On and Rule status set to Off." lightbox="./media/scoping/control-access-scope-tags-toggle.png":::

  6. Select Save.

Step 4: Access scoped data

Use the SentinelScope_CF custom field in queries and detection rules to reference scope in your analytics.

:::image type="content" source="./media/scoping/scoped-alerts-view.png" alt-text="Screenshot of alerts filtered by Sentinel scope." lightbox="./media/scoping/scoped-alerts-view.png":::

Limitations of Microsoft Sentinel scoping

:::image type="content" source="./media/scoping/select-scopes-detection.png" alt-text="Screenshot of selecting specific scopes for a custom detection rule." lightbox="./media/scoping/select-scopes-detection.png":::

  1. If you're an unscoped user, you can also select All data. By selecting this option,All data, the rule is unscoped, runs over all data, and is visible and editable only to unscoped users.

  2. Complete the wizard and save the rule.

    :::image type="content" source="./media/scoping/review-scoped-detection.png" alt-text="Screenshot of the review step for a scoped custom detection rule." lightbox="./media/scoping/review-scoped-detection.png":::

Keep the following limits in mind for scoped custom detections:

  • Custom detections over AlertInfo and AlertEvidence aren't supportedignore scopes and run over all data, regardless of the defined scope.data.
  • Don't create scoped detections on unscoped tables. Querying unscoped tables from a scoped detectionThese detections always returnsreturn no results.
  • Scoped detections can't use custom frequency whenwith XDR tables. XDR tables are includedunscoped in the query. Custom frequency requires data to be fetched from Sentinel, where XDR tables are unscoped. XDR tablesso only unscoped detections can only be queried by unscoped detections.query them.

Create scoped automation rules

  1. In the Microsoft Defender portal, go to Microsoft Sentinel > Configuration > Automation.

  2. Open the Enhanced rules tab.

    :::image type="content" source="./media/scoping/automation-enhanced-rules.png" alt-text="Screenshot of the Enhanced rules tab in Automation." lightbox="./media/scoping/automation-enhanced-rules.png":::

  3. Select Create to add a new automation rule, then fill in the details for your automation rule.

    :::image type="content" source="./media/scoping/create-automation-rule.png" alt-text="Screenshot of creating a new enhanced automation rule." lightbox="./media/scoping/create-automation-rule.png":::

  4. Select the Sentinel scope to apply to the rule:

    • If you're a scoped user (you have one or more Sentinel scopes assigned to you), you must choose a scope.
    • If you're an unscoped user, you can choose All available and future Sentinel scopes.

    :::image type="content" source="./media/scoping/automation-rule-scope.png" alt-text="Screenshot of the Sentinel scope selector for an automation rule." lightbox="./media/scoping/automation-rule-scope.png":::

  5. Save the rule.

The automation rule applies to the data associated with the Sentinel scope you selected scopefor the rule and is only visible to users assigned to that scope.