Security & Compliance Center RBAC vs Azure AD admin roles

[Bedrich Chaloupka]

Please is there any clear documentation (mapping) of what is relation between AAD admin roles and the Security & Compliance Center (SCC) RBAC roles? In both admin centers is possible to add someone as member of Security Administrator, Security Reader, Compliance Administrator and other roles, but the administrative features set available in the SCC is different based on whether the role was assigned in AAD or in SCC. I know the roles have same names and different purpose, but obviously the AAD admin roles enable some admin features in SCC, but different than expected. Did not find this anywhere documented except a not that Global admin gets automatically Organization Management role in SCC. This looks quite chaotic.

[#2]

There is a difference between a Role Group (what EAC and the SCC use) and Roles, as used by the Azure AD, as the formed can be customized. In a nutshell though, assigning a user with one of those roles in AAD should add him to the relevant Role Group in the SCC, so they should give the same set of permissions.

The AAD roles are documented in details here, down to the individual permission entry: https://docs.microsoft.com/en-us/azure/active-directory/users-groups-roles/directory-assign-admin-ro...

Some additional information about the SCC roles can be found here: https://docs.microsoft.com/en-us/office365/securitycompliance/permissions-in-the-security-and-compli...

[#3]

Thank you for your response. You are completely correct that the AAD admin roles should add the individual to relevant SCC role and provide same set of permissions, but it obviously does not work like that. The set of given permissions is different and the individual even does not appear in the members list of any of the SCC admin roles.  

[#4]

That's the point, he doesn't need to appear there. Much like you don't see all your Global admins listed as members of each Role Group in EAC/SCC. Instead, you see the "placeholder" groups such as "TenantAdmins_c25d1" or "SecurityAdmins_-417435872".

[#5]

Actually, it turns out the SCC groups do NOT include the "placeholder" groups such as TenantAdmins.

Here's a comparison between the EAC Role Group:

Get-RoleGroupMember "Organization Management"

Name               RecipientType
----               -------------
TenantAdmins_c25d1 Group

And the SCC role group:

Get-RoleGroupMember OrganizationManagement

Name         RecipientType
----         -------------
Vasil Michev MailUser

So yeah, you have to add them manually.

[#6 · Accepted solution]

Well it is even more complex. Microsoft's documentation says that the Global admin is automatically added as member of Organization Management role in SCC, but if you open SCC Admin site as Global admin you will see different management options then if you just add somebody to the Organization Management role in SCC. The same happens with Compliance Administrator, Security Administrator or Reader, which are AAD admin roles as well as SCC admin roles.

[#7]

@Bedrich Chaloupka @VasilMichev  I was about to post a similar question based on days of trying to figure this out. So, thank you for already discussing this in advance!

I wanted to create a Role Group in the SCC for Records Managers to create and manage retention policies and manage dispositions. The two roles that appear (on the face of it) to allow this are 'Retention Management' and 'Disposition Management' as well as 'RecordManagement', which role doesn't seem to do anything. 

But I also need the records managers to have the ability to search the audit logs, now that these have vanished from SPO. So I added the 'Audit Logs' role. However, this gives access to a whole bunch of additional options that I don't want the records manager to have. 

Have either of you seen a matrix that defines what section/option appears for each specific role? Or a script that can produce this? 

Also, another inconsistent experience is that:

• If you grant the user an Admin role from the EAC, they see the 'Admin' app in Office.com, and from there can get to the SCC portal. 
• If grant the user the same role in the SCC (but not in the EAC), they don't get the 'Admin' app but can access the SCC portal. This means they have to be told the SCC URL to get to it. 

[#8]

I've read those documents a few time now and still don't see the difference and/or crossover between AAD role and Compliance Centre roles.