Microsoft Defender XDR
GeneralCustom Permissions Details
In brief
The page now lists URL-click alerts among the alert types supported by the “Emails associated with alerts” read permission, alongside malware/phish and junk reports.
What Defender admins need to know
Administrators can use the expanded list when reviewing custom permission scope and email-content access.
Summaries are generated from the documentation change itself.
Documentation change
View on Microsoft LearnThe comparison below shows only the changed extract. Use the full-page view for complete context.
| --- | --- | --- |
| Email & collaboration metadata | Read | View email and collaboration data in hunting scenarios, including advanced hunting, threat explorer, campaigns, and email entity. |
| Email & collaboration content | Read | View and download email content and attachments. |
| Email & collaboration content: Emails associated with alerts | Read | View and download email content associated with security alerts Email reported by user as malware or phish and Email reported by user as junk.alerts. |
| Email & collaboration content: Quarantine Emails | Read | View and download quarantined messages for all users. |
Note
The Email & collaboration content: Emails associated with alerts permission is only supported for the alerts Email reported by user as malware or phish, Email reported by user as junk, A potentially malicious URL click was detected and A user clicked through to a potentially malicious URL.
Security posture – Posture management
Permissions for managing the organization's security posture and performing vulnerability management.
@@ -38,12 +38,12 @@ item_type: Content source_path: defender-xdr/custom-permissions-details.md cmProducts: - https://microsoft-devrel.poolparty.biz/DevRelOfferingOntology/c671beaa-a830-4c9f-aceb-97379ee031ca+- https://authoring-docs-microsoft.poolparty.biz/devrel/fcc3cd4a-59ea-47a2-9cc1-784142a5a25d - https://authoring-docs-microsoft.poolparty.biz/devrel/8f37329d-5c2f-4d50-b9b8-aa5cf54dbffe-- https://microsoft-devrel.poolparty.biz/DevRelOfferingOntology/1577a46d-8446-40bd-bfae-0578362f4d94 spProducts: - https://microsoft-devrel.poolparty.biz/DevRelOfferingOntology/8921374c-4dbe-4ed0-b011-a39e18bfbd98+- https://authoring-docs-microsoft.poolparty.biz/devrel/d7a55faf-a992-4e27-aa3a-eadc9830e778 - https://authoring-docs-microsoft.poolparty.biz/devrel/e13db295-3de6-46d5-bcdf-8785a76e3843-- https://microsoft-devrel.poolparty.biz/DevRelOfferingOntology/cdf3f22d-5420-4d59-a2bf-66d6b3d9c828 platformId: 6ff0415e-f9d4-591f-4ed6-880ed939b8d6 --- @@ -76,9 +76,13 @@ Permissions for managing day-to-day operations and responding to incidents and a | --- | --- | --- |
| Email & collaboration metadata | Read | View email and collaboration data in hunting scenarios, including advanced hunting, threat explorer, campaigns, and email entity. |
| Email & collaboration content | Read | View and download email content and attachments. |
-| Email & collaboration content: Emails associated with alerts | Read | View and download email content associated with security alerts **Email reported by user as malware or phish** and **Email reported by user as junk**. |
+| Email & collaboration content: Emails associated with alerts | Read | View and download email content associated with security alerts. |
| Email & collaboration content: Quarantine Emails | Read | View and download quarantined messages for all users. |
+Note
+
+The **Email & collaboration content: Emails associated with alerts** permission is only supported for the alerts **Email reported by user as malware or phish**, **Email reported by user as junk**, **A potentially malicious URL click was detected** and **A user clicked through to a potentially malicious URL**.
+
## Security posture – Posture management
Permissions for managing the organization's security posture and performing vulnerability management.