Forum Discussion
Defender for Identity - Required permissions
Hi, in the Microsoft docs for DFI https://docs.microsoft.com/en-us/defender-for-identity/role-groups#required-permissions-for-the-microsoft-365-defender-experience it calls out the following for perm...
Martin_Schvartzman
Microsoft
MicrosoftThank you for your feedback.
We've updated the documentation to better describe the permissions needed:
Security Administrator is not sufficient for creating the MDI Workspace.
Since there are three groups created in the background when creating the MDI Workspace, you must be either Global Administrator or Security Administrator AND Group Administrator.
I had opened a ticket at MS because of this issue.
Or has anything changed here?
- Martin_Schvartzman
Security Administrator should be enough. The groups are created by the 1st party 'Azure Advanced Threat Protection' application that gets registered in your tenant.
- Then have you have to have the permission to register this application?
However: Security Admin was not sufficient 2 months ago. But maybe something has changed in the meantime.