Restrict access to event timeline for privacy reasons

[agua_todo_el_dia]

The event timeline per device in within Microsoft Defender for Endpoint might be great for incident response.

However, I see a privacy violation as some users only use the portal for vulnerability management and hardening and do not need to see detailed event timelines.

Is it possible to either a) disable it at all or b) restrict access to users that use Microsoft Defender for Endpoint for vulnerability management and hardening purposes only.

[#2]

Hi @agua_todo_el_dia,

Yes this is possible. You can achieve this by assigning roles. Please refer to the illustrations below:

Please let me know if this helps answer your question.