Microsoft Defender: Expanded URBAC permission support for email content access

What and why

We’re expanding Unified role-based access control (URBAC) permission support for Email & collaboration content: Emails associated with alerts in Microsoft Defender. This change provides more consistent email content access across alert investigation scenarios based on a user’s assigned permissions.

Previously, this permission applied to:

• Email reported by user as malware or phish
• Email reported by user as junk

With this rollout, the permission will also apply to:

• A potentially malicious URL click was detected
• A user clicked through to a potentially malicious URL

Rollout schedule

General Availability (Worldwide): Available now

Impact on your organization

Who is affected

• Security analysts who preview or download emails associated with the affected alerts

Platforms and services

• Microsoft Defender

What will happen

Security analysts with the required permission will be able to preview and download emails associated with these four alerts:

• Email reported by user as malware or phish
• Email reported by user as junk
• A potentially malicious URL click was detected
• A user clicked through to a potentially malicious URL

Access is based on the user’s assigned Email & collaboration content: Emails associated with alerts permission.

Action required and recommendations

Ensure that users who need to preview and download emails associated with these four alerts have the required Email & collaboration content: Emails associated with alerts permission.

Learn more

• Permissions in Microsoft Defender unified role-based access control (RBAC) - Microsoft Defender XDR | Microsoft Learn

Compliance considerations

No compliance considerations identified. Review as usual for your organization.