MDI Roles/Permissions - where art thou now ?

[StuartH .]

It used to be simple. In ATP (now MDI), there used to be 3 groups used for administration/viewing (Azure ATP [workspace] Admin, Azure ATP [workspace] Users and Azure ATP [workspace] Viewers).

Having gone round and round in Role groups - Microsoft Defender for Identity | Microsoft Learn - I am now lost on whether this is still the case, as I have recently heard a few of my MDI "admins" (with the ATP User group) can no longer manage alerts. They used to be able to, and now it is greyed out and if you hover over the button it says "You don't have permissions to perform this action".  Has RBAC gone up the wazzoo since the forced transition to the new portal ?  There is no menu/config for Identity permissions...so I don't even know where those groups are shown any more.  Anyone know ?

[#2]

@StuartH . you can now create a custom role from MD365 permission blade for the admin they need to manage the security alerts for MDI. 

Please click Mark as Best Response & Like if my post helped you to solve your issue. This will help others to find the correct solution easily.

[#3]

Hey @eliekarkafy 

Thanks for the quick response. So, are you saying the previous ATP roles (Admin, User & Viewer) are no longer used ? If they are supposed to be, they seem not to be working !

Can you detail your exact steps to get to Permissions & Roles|Microsoft Defender, as that is not what I see in our security.ms.com (Defender) portal as I see:

[#4]

@StuartH . from the new permissions blade in Defender, under M365 Defender click on Roles 

then click on custom role to create your MDI custom role 

[#5]

@eliekarkafy  mmm, that might be an issue, as I don't even see Microsoft 365 Defender as an item under Permissions. Is this valid for an Enterprise customer - RBAC not available for Defender for Business and hence why it is not showing ?  I have looked in two of our tenants, as a Global Admin, and it is not in either 

Asides....can you tell me whether those "old" permissions groups are no longer used ?  I just don't see that doc'ed anywhere, and I would have thought that there would have been something doced if there was some expectation on customers to migrate from the old way to the new way. Now we are seemingly in a position whereby our admins can't seem to manage MDI alerts. As a global admin, of course, I can still manage the backend MDI settings/sensors etc.

[#6]

The ATP groups can be found in Azure AD under group 

[#7]

@eliekarkafy - I am using Global Admin to view the Defender portal - so one would hope I could see it !  That's what makes me think that something is awry here.  If not available [yet], then it just enforces my other question, as whether the "old" Admin/User/Viewer roles are still valid ?

[#8]

yes they are still valid , but it should appear for you that option to create custom role for MDI .

[#9]

Yes, and these are unchanged in our Azure AD....they have been there for 6+ years !! My point is....it does not seem that (in your example), Azure ATP newampio Users, is being honoured. Users in this group, can no longer manage alerts.....which they used to be able to do. Bug ?

[#10]

@StuartH . try to access it in different way , go to settings -- M365 Defender -- Permissions and Roles and then click on Go to permissions and roles 

did you enable that feature circled in Yellow ? 

[#11]

@eliekarkafy   don't have that option shown either.  I have looked in both of our tenants, both running as a Global Admin:

[#12]

if you're signing in with a Global admin and you're missing some settings, i suggest you open a ticket with the security team so they can check your tenant.

[#13]

@eliekarkafy  of course, I can log a ticket and will, but it is possible that all of this new RBAC stuff related to MDI is not public ready/released yet for an Enterprise org that is running Defender. Is that a fair assessment ?

Question remains though - should the "older" Admin/User/Viewer ATP roles still work and be capable of being used ?  If so, then it is seemingly broken, and I would need a ticket for that too.

[#14]

yes better to open a ticket with the security so they can check your issue with the ATP roles

[#15]

@StuartH . keep me posted with MS reply 

[#16]

@StuartH . 
Hi, the classic MDI roles still work but have many caveats when used, such as the need for additional permissions to view all identity related experiences, so the recommendations are to use the more granular M365 RBAC capabilities or global roles.

If you don't have the former available in your tenant, please send me your Tenant ID so i can check why it is not enabled.

[#17]

OK, so after some tenuous conversations with support and PG

None of the "stuff" is available UNLESS you have the Defender Preview enabled. 

Once you enable that, you can import legacy roles (the Azure ATP groups), and then after lightning up the Identity workload....you are back to how things were before the move to the Defender Portal move.

Not throwing anyone under the bus here, but why was it deemed a good call to put this behind a preview button, and not tell people about it ?  We have been using Azure ATP/MDI for 6+ years, and the move to the new portal actually seem to have broken all of the delegation which has worked well for all that time.  Worst....it is not doc'ed.

[#18]

Hi StuartH, happy to continue this discussion, can you please ping me at ort@microsoft.com so we can think of the proper way to make sure permissions are not broken during the portal transition?