Forum Discussion
Pending Actions - Defender XDR
I don't have any actions to approve right now, so I can't check, but I had this issue for several months. I would get a 405 error. To be clear, this was not the case if I had Security Admin activated, but it wasn't working properly with the Unified RBAC roles.
I haven't been able to replicate this issue in 2 environments. Only other thing I can think of is Device Groups, if the machine is in a device group that the RBAC role doesn't have full rights over I've seen a similar issue where admins could see incidents but couldn't act on them, which ended up being that the devices were in a device group the Admins rbac had no rights to. i.e resolve by adding the rbac group here
My issue was some time ago in 2024, and was resolved by Microsoft after I had a ticket open for a while.