Skip to content

Latest commit

 

History

History
96 lines (66 loc) · 3.91 KB

basic-permissions.md

File metadata and controls

96 lines (66 loc) · 3.91 KB
Raw
title description ms.service ms.subservice ms.author author ms.localizationpriority ms.custom manager audience ms.collection ms.topic search.appverid ms.date
Use basic permissions to access the portal
Learn how to use basic permissions to access the Microsoft Defender for Endpoint portal.
defender-endpoint
onboard
siosulli
siosulli
medium
has-azure-ad-ps-ref
azure-ad-ref-level-one-done
deniseb
ITPro
m365-security
tier2
conceptual
met150
06/25/2024

Use basic permissions to access the portal

[!INCLUDE Microsoft Defender XDR rebranding]

Applies to:

Want to experience Defender for Endpoint? Sign up for a free trial.

If you want to use basic permissions management for the Microsoft Defender portal, keep in mind that permissions are set to either full access or read only. For granular control over permissions, use role-based access control.

Assign user access using Microsoft Graph PowerShell

You can assign users with one of the following levels of permissions:

  • Full access (Read and Write)
  • Read-only access

Before you begin

  • Install Microsoft Graph PowerShell. For more information, see, How to install Microsoft Graph PowerShell.

    [!NOTE] You need to run the PowerShell cmdlets in an elevated command-line.

  • Connect to your Microsoft Entra ID. For more information, see Connect-MgGraph.

    • Full access: Users with full access can log in, view all system information and resolve alerts, submit files for deep analysis, and download the onboarding package. Assigning full access rights requires adding the users to the "Security Administrator" or "Global Administrator" Microsoft Entra built-in roles.

    • Read-only access: Users with read-only access can log in, view all alerts, and related information.

      They will not be able to change alert states, submit files for deep analysis or perform any state changing operations.

      Assigning read-only access rights requires adding the users to the "Security Reader" Microsoft Entra built-in role.

Use the following steps to assign security roles:

  • For read and write access, assign users to the security administrator role by using the following command:

    $Role = Get-MgDirectoryRole -Filter "DisplayName eq 'Security Administrator'"
$UserId = (Get-MgUser -UserId "secadmin@Contoso.onmicrosoft.com").Id

$DirObject = @{
  "@odata.id" = "https://graph.microsoft.com/v1.0/directoryObjects/$UserId"
}

New-MgDirectoryRoleMemberByRef -DirectoryRoleId $Role.Id -BodyParameter $DirObject

  • For read-only access, assign users to the security reader role by using the following command:

    $Role = Get-MgDirectoryRole -Filter "DisplayName eq 'Security Reader'"
$UserId = (Get-MgUser -UserId "reader@Contoso.onmicrosoft.com").Id

$DirObject = @{
  "@odata.id" = "https://graph.microsoft.com/v1.0/directoryObjects/$UserId"
}

New-MgDirectoryRoleMemberByRef -DirectoryRoleId $Role.Id -BodyParameter $DirObject

For more information, see Add or remove group members using Microsoft Entra ID.

Related articles

[!INCLUDE Microsoft Defender for Endpoint Tech Community]