Microsoft Defender: Expanded URBAC permission support for email content access
What and why
We’re expanding Unified role-based access control (URBAC) permission support for Email & collaboration content: Emails associated with alerts in Microsoft Defender. This change provides more consistent email content access across alert investigation scenarios based on a user’s assigned permissions.
Previously, this permission applied to:
- Email reported by user as malware or phish
- Email reported by user as junk
With this rollout, the permission will also apply to:
- A potentially malicious URL click was detected
- A user clicked through to a potentially malicious URL
Rollout schedule
General Availability (Worldwide): Available now
Impact on your organization
Who is affected
- Security analysts who preview or download emails associated with the affected alerts
Platforms and services
- Microsoft Defender
What will happen
Security analysts with the required permission will be able to preview and download emails associated with these four alerts:
- Email reported by user as malware or phish
- Email reported by user as junk
- A potentially malicious URL click was detected
- A user clicked through to a potentially malicious URL
Access is based on the user’s assigned Email & collaboration content: Emails associated with alerts permission.
Action required and recommendations
Ensure that users who need to preview and download emails associated with these four alerts have the required Email & collaboration content: Emails associated with alerts permission.
Learn more
Compliance considerations
No compliance considerations identified. Review as usual for your organization.