Forum Discussion

MarcinRDR's avatar
MarcinRDR
Copper Contributor
Jan 31, 2024

Defender RBAC - Grant at least priviliged for Quarantine handling NOT WORKING

Hi everyone,   I've already deployed new Defender RBAC permission. I want to assign permission for quarantine message handling WITHOUT Preview Message option. I,ve configured Defender RBAC in fol...
accessibility
Microsoft Defender for Office 365
HeikeRitter's avatar
HeikeRitter
Icon for Microsoft rankMicrosoft
Thank you for sharing this detailed case. The team was able to repro it, and they are on it.
FaithEbenezerOquong's avatar
FaithEbenezerOquong
Icon for Microsoft rankMicrosoft
Feb 05, 2024

MarcinRDR thanks for bringing this feedback to our attention. 

 

After investigation into the concern you raised, we have found that this is by design. 

 

Security reader role have the permission Review and preview all messages that have been quarantined for all users in the organization. Manage quarantined messages and files as an admin | Microsoft Learn

 

please note that this is specifically for Quarantined messages. This does not apply to messages that have already made it to the user inbox folder. 

 

this design has always existed prior to Unified role-based access control feature. 

  • MarcinRDR's avatar
    MarcinRDR
    Copper Contributor
    Feb 06, 2024
    Hi,

    Thanks for answer.
    My users is assigned only to Defender RBAC.
    Tested user has not been assigned in Entra ID roles as security reader or security admin.
    The user has not been assigned to any roles in Entra ID or Azure RBAC

Resources