Microsoft Defender: Expanded URBAC permission support for email content access

Microsoft Defender has expanded Unified role-based access control (URBAC) permissions for email content access to include alerts related to potentially malicious URL clicks. Security analysts with the appropriate permission can now preview and download emails from four alert types, ensuring consistent access across scenarios. We’re expanding Unified role-based access control (URBAC) permission support for Email & collaboration content: Emails associated with alerts in Microsoft Defender. This change provides more consistent email content access across alert investigation scenarios based on a user’s assigned permissions. Previously, this permission applied to: Email reported by user as malware or phish Email reported by user as junk With this rollout, the permission will also apply to: A potentially malicious URL click was detected A user clicked through to a potentially malicious URL Rollout schedule General Availability (Worldwide): Available now Impact on your organization Who is affected Security analysts who preview or download emails associated with the affected alerts Platforms and services Microsoft Defender What will happen Security analysts with the required permission will be able to preview and download emails associated with these four alerts: Email reported by user as malware or phish Email reported by user as junk A potentially malicious URL click was detected A user clicked through to a potentially malicious URL Access is based on the user’s assigned Email & collaboration content: Emails associated with alerts permission. Action required and recommendations Ensure that users who need to preview and download emails associated with these four alerts have the required Email & collaboration content: Emails associated with alerts permission. Learn more Permissions in Microsoft Defender unified role-based access control (RBAC) – Microsoft Defender XDR | Microsoft Learn Compliance considerations No compliance considerations identified. Review as usual for your organization. Message ID: MC1536045

The post Microsoft Defender: Expanded URBAC permission support for email content access appeared first on M365 Admin.