Microsoft Secure Tech Accelerator
Apr 03 2024, 07:00 AM - 11:00 AM (PDT)
Microsoft Tech Community
SOLVED

Access control?

Deleted
Not applicable

Is there a way to restrict who can access ATP?  I am just onboarding and I've found any user can access it - which could be a bit of a problem.

 

 

4 Replies
Hi, in my experience only a Global Administrator can access the content of the Azure ATP.
Thanks. Turned out the users I asked to try it was Global admins. I've tested with someone else and they could not get access.
best response
Solution

Azure ATP creates three AAD groups which you can use to provide access to each Azure ATP workspace you create: They are named Azure ATP <WorkspaceName> Administrators; Azure ATP <WorkspaceName> Users and Azure ATP <WorkspaceName> Viewers. Details on what each group can access can be found here: https://docs.microsoft.com/en-us/advanced-threat-analytics/ata-role-groups 

 

Adding users to these AAD groups will give them access to an individual workspace (they will need to use the full workspace URL).

 

Only Global Administrators and Security administrators can access the Workspace management portal at https://portal.atp.azure.com

At the https://portal.atp.azure.com you see a little link and help button in the upper right corner. It says there are three groups namein "Azure ATP [workspace] [role]"
1 best response

Accepted Solutions
best response
Solution

Azure ATP creates three AAD groups which you can use to provide access to each Azure ATP workspace you create: They are named Azure ATP <WorkspaceName> Administrators; Azure ATP <WorkspaceName> Users and Azure ATP <WorkspaceName> Viewers. Details on what each group can access can be found here: https://docs.microsoft.com/en-us/advanced-threat-analytics/ata-role-groups 

 

Adding users to these AAD groups will give them access to an individual workspace (they will need to use the full workspace URL).

 

Only Global Administrators and Security administrators can access the Workspace management portal at https://portal.atp.azure.com

View solution in original post