Forum Discussion
Can't find correct RBAC permissions to approve AIR actions
I've been configuring custom RBAC roles, and even though the "Response (manage)" permission in the Security Operations permissions group includes "approve or dismiss pending remediation actions," it doesn't work. I've tried it with pending "soft delete emails" actions in the Action Center, and I get an error. The only way we can approve or reject these actions is with the Entra Security Administrator role checked out.
Does anyone know which RBAC permission is supposed to grant the rights to approve these remediation actions?
5 Replies
Hi RSKadish,
In this example indeed you need the Entra Security Administrator role.
Full Action Center permissions below:
https://learn.microsoft.com/en-us/defender-xdr/m365d-action-center#required-permissions-for-action-center-tasks
I recommend to use PIM so operators only elevate their permissions when needed:
https://learn.microsoft.com/en-us/entra/id-governance/privileged-identity-management/pim-getting-startedHi Youri,
Thank you. We already use PIM, but I'm trying to get people away from using Security Administrator for things like releasing emails.
In the article you cited, I'm referring to THIS section:
https://learn.microsoft.com/en-us/defender-xdr/manage-rbac
- Microsoft Defender for Endpoint remediation: Security operations \ Security data \ Response (manage).
- Microsoft Defender for Office 365 remediation (Office content and email, if Email & collaboration > Defender for Office 365 permissions is
Active. Affects the Defender portal only, not PowerShell):- Read access for email and Teams message headers: Security operations/Raw data (email & collaboration)/Email & collaboration metadata (read).
- Remediate malicious email: Security operations/Security data/Email & collaboration advanced actions (manage).
I already have a custom role configured with these permissions, but that role can't approve/reject pending actions.
Best regards,
- Steve
Hi Steve,
I was just looking at this for someone and found it can get quite complex when you move to XDR permissions.
Option 1: XDR Permissions
From what I've seen you have to "hijack" the permissions in XDR from MDO before AIR approvals will work (specifically the soft-delete action). Which is fine, but requires a bit of planning as the built-in roles no longer function as expected.
Enable the MDO workload here: https://security.microsoft.com/securitysettings/defender/mtp_roles
Option 2: Traditional RBAC permissions
Otherwise the least privileged option out-of-the-box appears to be Global Reader + the Data Investigator (MDO) role.MDO Permissions here: https://security.microsoft.com/emailandcollabpermissions
Permissions for AIR capabilities are described by Microsoft here:
https://learn.microsoft.com/en-us/defender-office-365/air-about#required-permissions-to-use-air-capabilities
