Event details
My client has an E5 license and he's an azure global admin.
he's having difficulty enabling the "Office 365 Threat Intelligence connection"
feature in the defender portal > settings > endpoint.
it says he doesn't have permission (but he's global admin)
Azure Global Admin != M365 Global Admin != Defender Admin - even if you have GA roles, that role is not super powerful - cannot execute many things and actions in Microsoft Purview Portal and Microsoft Defender Portal. You have to apply proper permission for products and subproducts inside M365.
- Ed Fisher
Microsoft
Tobias is quite right, but just to add a little more specificity to this, to enable the Office 365 Threat Intelligence connection, you need to have Security Administrator permissions.- thanks Ed, I think the catch was he needs Sec Admin in the Compliance portal, not AAD.
- yes but what role? he's added to a full admin role in the defender portal and he has the security admin role in AAD.
