Hi, I think there is some good improvements that could be made to RBAC: 1. Limit what can be viewed, e.g. timeline is not suitable for GDPR in Europe or will not sit well with unions. 2. Tag's should be able to be applied in automated fashions like Machine groups. Sometimes you will want to link an action to a tag. Such as apply web filtering for different regions and groups of people. In some cases this would help whereby you base it on the tag rather than the machine group otherwise with only being a member of one machine group you can loose the functionality you would expect. Something else slightly related is that if you use SCEP with Win 7 it seems like ATP can read what happens on the OS but will not report a virus even if it is detected on the endpoint. It will however pick up powershell examples at least but won't pull any logs. Since Windows 7 is around for another 3 years is it not important to add some of the basic level features? i.e. Scan, collect logs, check definitions are in date, submit samples and isolation (could be done with some firewall rules). I
Microsoft