Summary
- Microsoft Defender RBAC is becoming the single permissions model for Microsoft Defender and Microsoft Sentinel portal experiences.
- Existing legacy roles will be automatically imported into the new RBAC model so admins can review and adjust role assignments before activation.
- After activation, portal authorization will use Defender RBAC by default; legacy role assignments will no longer be required for those portal experiences.
- Some permissions remain unchanged, including Entra directory roles, Exchange Online/Purview permissions, Azure RBAC for Azure resources, and delegated access/B2B/GDAP handling.
- Organizations using Microsoft Defender for Office 365 Plan 2 and tenants managing roles via APIs should plan to move to the new Defender RBAC API and validate imported assignments.
Primary Service: Defender XDR
Admin Impact: High
User Impact: Low
Release Start: 03 Nov 2026
Release End: 03 Nov 2026
Services: Azure, Defender XDR, Entra, Exchange, Graph, Purview, Security
Category: Plan for change
Tags: Admin Action
History
11/3/2026 Item Added to Message Center
Microsoft Message
Microsoft Defender role-based access control (Defender RBAC), the unified permissions model for Defender, is becoming the single access model for all Defender and Sentinel portal experiences. This will happen in a phased roll-out.
First, your existing roles will be imported into the new RBAC model, giving you time to review and adjust them during the notification period. Following this period, the new Defender RBAC will be activated automatically for the in-scope workload(s), approximately 30 days after the in-portal notification date.
The new Defender RBAC offers more extended access management capabilities, including:
- A single access management system to manage all roles and permissions across all workloads.
- Scoping capabilities across device groups, cloud, identity, and Sentinel.
- Future-proof assignments that will allow you to include future permissions and workloads.
- A prerequisite for newly introduced offerings, such as Perception.
This change applies to Microsoft Defender and Microsoft Sentinel. Permissions for Microsoft Purview, Exchange Online, Microsoft Entra directory roles, Privileged Identity Management, and Azure resources (not related to
Microsoft Sentinel) remain unchanged. In addition, if you are using PowerShell with Microsoft Defender for Office 365, this will continue to work as is.
Workloads: The portal will identify which workloads will be enabled automatically and their activation dates.
How you will be notified:
- Notification banner: A notification will be displayed in the Microsoft Defender portal informing customers that the specified workload(s) will transition to the new RBAC model. Legacy roles are automatically imported. The notification banner and role import mark the beginning of the customer notification period before automatic activation.
- Activation date: Beginning approximately 30 days after the notification date, the new Defender RBAC will be enabled automatically for the specified workload(s). Customers can review imported role assignments and prepare for the transition during this period.
- The in-portal banner in the Microsoft Defender portal (‘Permissions and roles’ page) will confirm activation.
Rollout Schedule
Global: We will begin rolling out early December 2026 and expect to complete by late January 2027.
Impact on Your Organization
- Your existing roles, if applicable, will be automatically imported into the new Defender RBAC. Because the new RBAC is not yet active on your tenant for the workloads indicated, this import has no operational impact until activation. You may review and adjust the imported roles at any time from the Microsoft Defender portal. You may also re-run the import manually. Existing roles and permissions are automatically mapped. For more information on mapping, please see here.
- At the end of the notification period, the new Defender RBAC will be activated automatically for the in-scope workload(s). After activation, authorization for Defender/Sentinel portal experiences defaults to the new RBAC roles; legacy role assignments are no longer required to operate those portal experiences.
- Opt-out: Self-service opt-out is available after activation. Go to the ‘workload settings’ control in Defender RBAC to instantly revert to your legacy system if needed.
- If you are using APIs to configure your roles and permissions, please transfer to using the new Defender RBAC API
- Delegated access (B2B/GDAP) or Multi-Tenant Management: remains unchanged. Roles that had assignments to B2B/GDAP users/groups will be included in the automatic import.
- Entra directory roles are unchanged. Global Administrator, Security Administrator, Security Operator, and Security Reader continue to grant access to the Microsoft Defender portal as they do today. These roles will now map to Defender RBAC permissions as per the mapping referenced earlier. For more information on this mapping, please see here. https://learn.microsoft.com/en-us/defender-xdr/compare-rbac-roles
- Azure RBAC continues to govern Azure resources, including Logic Apps and Workbooks. Microsoft Sentinel specific workspace permissions (Sentinel Reader, Responder, Contributor roles) do get enabled automatically to Defender RBAC.
- Email and Collaboration permissions and Exchange Online permissions continue to govern Exchange Online and Microsoft Purview scenarios. They are no longer required to operate Microsoft Defender for Office 365 portal experiences once Defender RBAC is active.
- Applicability for Microsoft Defender for Office 365: This update applies to organizations with Microsoft Defender for Office 365 Plan 2, whether licensed separately or included in an eligible subscription, such as Microsoft 365 E5.
Action Required/Recommendations
From the moment of the in-portal notification, review the auto-imported RBAC role assignments in the Microsoft Defender portal (Permissions -> Roles). Validate that each user has the expected RBAC role and scope. Adjust assignments as needed. If any role assignments need to be updated, you can do so directly in the role assignment, even if Defender RBAC is not yet activated for that workload.
When using scoping: device groups continue to work as they do today. In addition, Defender RBAC allows you to use Cloud Scopes, Sentinel Scopes, and Identity Scopes.
Update internal documentation and runbooks to reflect the new RBAC model.
Additional information:
- Microsoft Defender RBAC overview
- Review and manage imported RBAC roles
Compliance considerations
This update changes the permissions/access-control model for Microsoft Defender and Microsoft Sentinel only; Microsoft Purview, Exchange Online, Microsoft Entra directory roles, Privileged Identity Management, and Azure resource permissions are unchanged. Review imported role assignments against your organization change-management and access-governance requirements before activation.