Microsoft Defender XDR
GeneralAutomatic Attack Disruption Exclusions
In brief
The documentation now explains that identity exclusions affect automated response actions in both Defender for Identity and Defender for Endpoint. It clarifies Unified RBAC permissions for both products’ data sources and adds guidance on role assignments and data-source scope.
What Defender admins need to know
Administrators managing identity exclusions should review the updated permissions table and confirm their role assignments cover the relevant product data sources.
Summaries are generated from the documentation change itself.
Documentation change
View on Microsoft LearnThe comparison below shows only the changed extract. Use the full-page view for complete context.
- usx-security
- usx-security
ms.topic: how-to
ms.date: 2026-
08-07T00:10-04T00:00:00.0000000Z ai-usage: ai-assisted ms.custom: msecd-doc-authoring-10151028 locale: en-us document_id: f3006777-871c-e28b-7788-ece7737856a9 document_version_independent_id: f3006777-871c-e28b-7788-ece7737856a9
Prerequisites
The permissions required to manage attack disruption exclusions depend on whether Microsoft Defender XDR Unified role-based access control (RBAC) is enabled for the relevant workload.product.
Device exclusions
Identity exclusions
Identity exclusions affect automated response actions in both Defender for Identity and Defender for Endpoint. The following table lists the permissions required to manage identity exclusions.exclusions for each deployed product.
| Unified RBAC for identities |
Required permission |
|---|---|
| Disabled |
Security Administrator or Global Administrator role in Microsoft Entra ID or the Microsoft 365 admin center. |
| Enabled |
Security Operator (or higher) global Microsoft Entra role, or the Core security settings (manage) permission in Unified |
For information about role assignments and data-source scope, see Create a custom role.
Note
@@ -19,9 +19,9 @@ ms.collection: - usx-security - usx-security ms.topic: how-to-ms.date: 2026-08-07T00:00:00.0000000Z+ms.date: 2026-10-04T00:00:00.0000000Z ai-usage: ai-assisted-ms.custom: msecd-doc-authoring-1015+ms.custom: msecd-doc-authoring-1028 locale: en-us document_id: f3006777-871c-e28b-7788-ece7737856a9 document_version_independent_id: f3006777-871c-e28b-7788-ece7737856a9@@ -60,7 +60,7 @@ Excluding assets from automated responses isn't recommended. It can reduce the e
## Prerequisites
-The permissions required to manage attack disruption exclusions depend on whether [Microsoft Defender XDR Unified role-based access control (RBAC)](manage-rbac) is enabled for the relevant workload.
+The permissions required to manage attack disruption exclusions depend on whether [Microsoft Defender XDR Unified role-based access control (RBAC)](manage-rbac) is enabled for the relevant product.
### Device exclusions
@@ -75,12 +75,14 @@ For information about enabling Unified RBAC, see [Activate Microsoft Defender XD
### Identity exclusions
-The following table lists the permissions required to manage identity exclusions.
+Identity exclusions affect automated response actions in both Defender for Identity and Defender for Endpoint. The following table lists the permissions required to manage identity exclusions for each deployed product.
-| Unified RBAC for identities or endpoints | Required permission |
+| Unified RBAC for identities and endpoints | Required permission |
| --- | --- |
-| **Disabled** (both identities and endpoints) | Security Administrator or Global Administrator role in [Microsoft Entra ID](https://entra.microsoft.com) or the [Microsoft 365 admin center](https://admin.microsoft.com). |
-| **Enabled** (for identities or endpoints) | Security Operator (or higher) global Microsoft Entra role, **or** the [Core security settings (manage)](custom-permissions-details) permission in Unified RBAC. |
+| **Disabled for identities and endpoints** | Security Administrator or Global Administrator role in [Microsoft Entra ID](https://entra.microsoft.com) or the [Microsoft 365 admin center](https://admin.microsoft.com). |
+| **Enabled** | Security Operator (or higher) global Microsoft Entra role, **or** the [Core security settings (manage)](custom-permissions-details) permission in Unified RBAC for the **Microsoft Defender for Endpoint** and **Microsoft Defender for Identity** data sources. If either product isn't deployed, permission for its data source isn't required. |
+
+For information about role assignments and data-source scope, see [Create a custom role](create-custom-rbac-roles#create-a-custom-role).
Note