Summary
- Microsoft Defender is expanding URBAC support for the “Email & collaboration content: Emails associated with alerts” permission.
- Security analysts will now need this permission to preview or download emails tied to additional alert types, not just user-reported malware/phish or junk email.
- The newly covered alerts are malicious URL click detections and users clicking through to potentially malicious URLs.
- IT should verify that security analysts who investigate these alerts have the required Defender permission assigned.
Primary Service: Defender
Admin Impact: Medium
User Impact: Low
Release Start: 03 Nov 2026
Release End: 03 Nov 2026
Services: Defender, Defender XDR, Security
Category: Stay informed
Tags: Admin Action, Feature Update, User Adoption
History
11/3/2026 Item Added to Message Center
Microsoft Message
We’re expanding Unified role-based access control (URBAC) permission support for Email & collaboration content: Emails associated with alerts in Microsoft Defender. This change provides more consistent email content access across alert investigation scenarios based on a user’s assigned permissions.
Previously, this permission applied to:
- Email reported by user as malware or phish
- Email reported by user as junk
With this rollout, the permission will also apply to:
- A potentially malicious URL click was detected
- A user clicked through to a potentially malicious URL
Rollout schedule
General Availability (Worldwide): Available now
Impact on your organization
Who is affected
Security analysts who preview or download emails associated with the affected alerts
Platforms and services
Microsoft Defender
What will happen
Security analysts with the required permission will be able to preview and download emails associated with these four alerts:
- Email reported by user as malware or phish
- Email reported by user as junk
- A potentially malicious URL click was detected
- A user clicked through to a potentially malicious URL
Access is based on the user’s assigned Email & collaboration content: Emails associated with alerts permission.
Action required and recommendations
Ensure that users who need to preview and download emails associated with these four alerts have the required Email & collaboration content: Emails associated with alerts permission.
Learn more
Permissions in Microsoft Defender unified role-based access control (RBAC) – Microsoft Defender XDR | Microsoft Learn
Compliance considerations
No compliance considerations identified. Review as usual for your organization.