Forum Discussion

5 Replies

  • DanPan's avatar
    DanPan
    Copper Contributor
    To manage MDI alerts in M365 Security Center the “Security Operator” role does not seem to be enough. You need to have "Security Administrator" role. Correct?
  • DanPan's avatar
    DanPan
    Copper Contributor

    Hi Ricky Simpson 

     

    Great to see the integration into M365 Security Center. 

    But we have an issue with this new feature...
    If we close an alert in M365 Security Center or MCAS, the alert is not closed in MDI.

    The other way round works fine, if we close an alert in MDI it's closed in M365SC and MCAS.

     

    Is it a bug or by design ?


     

    • Ricky Simpson's avatar
      Ricky Simpson
      Former Employee

      DanPan Thanks for leaving your comment. 

       

      The experience should be that if you close an alert on Microsoft 365 Defender, it should close on Defender for Identity and it should close on MCAS. If this isn't the case, please get in touch with support to see what can be done to help.  

      • DanPan's avatar
        DanPan
        Copper Contributor
        Thanks for replying my post.
        I will open a support case.