Forum Discussion
Pending Actions - Defender XDR
Noticed that I don't have permissions anymore to approve actions in the action center. My roles have not changed, and I have Security Admin, Operator, Reader, etc. Has anyone else ran into ...
I haven't been able to replicate this issue in 2 environments. Only other thing I can think of is Device Groups, if the machine is in a device group that the RBAC role doesn't have full rights over I've seen a similar issue where admins could see incidents but couldn't act on them, which ended up being that the devices were in a device group the Admins rbac had no rights to. i.e resolve by adding the rbac group here
My issue was some time ago in 2024, and was resolved by Microsoft after I had a ticket open for a while.