Forum Discussion
How to get access to Move or Delete e-mail?
So this week I had some phishing e-mails that made it past Defender's filtering and were delivered to user mailboxes. I wanted to pull them back, so I found the relevant message the Defender XDR portal, and clicked on Take Action, but the only option available to me there was Submit to Microsoft for review. All the others, including Move or Delete, which is what I wanted, were grayed out. I'll add that was doing this using my Global Admin account.
Did some research and supposedly assigning my account the Data Investigator role or creating a custom role with Search and Purge capability would provide the desired access So I put my account into both of those groups, and I still can't access Move or Delete.
Anybody know what I am missing here? I’d be grateful for any information.
5 Replies
Hey Joseph_Moran
Can you check the following setting as well? Are both options enabled? It's under Unified SecOps portal > Settings > Defender XDR > Permissions and roles.
If I have answered your question, please mark your post as Solved
If you like my response, please consider giving it a like
Hello Joseph_Moran,
make sure in the Unified Security Operations portal (or Defender XDR) you have properly setup your Unified RBAC permissions and roles for you and your team. In Security operations permissions, there is an option for Email & collaboration advanced actions which will allow you to soft or hard delete the suspicious emails.
If I have answered your question, please mark your post as Solved
If you like my response, please consider giving it a like
Thank you for your response. Maybe I am missing something, but I have already selected "All read and manage permissions" under Security Operations. Moreover, I don't even have the option you've highlighted-- nor most of the others for that matter. Don't know if this is as a result of some other underlying thing I did not set up correctly...
Also, just stumbled across https://learn.microsoft.com/en-us/defender-xdr/custom-permissions-details, so wondering now if this is simply an issue of you don't get access to these permissions in the version of Defender that comes with 365 Business Premium.
