Permission to download all emails

[rbenson09]

Anyone run into an issue where a Security Reader is able to download all emails in Threat Explorer? I expect to be able to download emails that are quarantined for analysis, but they also have access to download emails that were originally delivered to Inbox and still remain there. Trying to figure out what allows that access.

[#2 · Accepted solution]

Hey @rbenson09 ! - thanks for your question, sounds like you need this documentation! - Investigate malicious email that was delivered in Microsoft 365, Find and investigate malicious emai...

The preview role is what gives access, and has to have been added to a role group, if that assists you on your search.

Hope this helps!

Ben.

[#3]

THANK YOU SO MUCH!! I've been looking everywhere for more info on this and have been back and forth with support to determine what allowed this access. Now to find out how to remove this. Very big help. Thanks again!