MC1536045 Medium
Microsoft Defender: Expanded URBAC permission support for email content access
Summary AI-generated
URBAC permission support in Microsoft Defender now covers emails tied to potentially malicious URL clicks, enabling consistent access for security analysts based on permissions.
Suggested actions AI-generated
- Ensure users have Email & collaboration content: Emails associated with alerts permission
Written by Azure OpenAI (gpt-4.1) from the text of the post below. It can be incomplete or wrong; the original post is authoritative.
Similar posts
Search for more like this- MC1268924 Microsoft Defender XDR: Email summary powered by Security Copilot on the email entity page
- MC1461704 Microsoft Defender XDR: Unified response actions across identity accounts
- MC1478005 Microsoft Defender for Office 365: View approver details for remediation actions in Advanced Hunting
- MC1479503 (Updated) Microsoft Defender for Cloud Apps: Permission changes for select App Governance Entra roles
- MC1239187 Defender for Office 365 URL click alerts now include Microsoft Teams
- MC1490905 Microsoft Defender for Office 365: Post-delivery protection for malicious QR codes in Microsoft Teams
Original post from Microsoft
[What and why]
We’re expanding Unified role-based access control (URBAC) permission support for Email & collaboration content: Emails associated with alerts in Microsoft Defender. This change provides more consistent email content access across alert investigation scenarios based on a user’s assigned permissions.
Previously, this permission applied to:
- Email reported by user as malware or phish
- Email reported by user as junk
With this rollout, the permission will also apply to:
- A potentially malicious URL click was detected
- A user clicked through to a potentially malicious URL
[Rollout schedule]
General Availability (Worldwide): Available now
[Impact on your organization]
Who is affected
- Security analysts who preview or download emails associated with the affected alerts
Platforms and services
- Microsoft Defender
What will happen
Security analysts with the required permission will be able to preview and download emails associated with these four alerts:
- Email reported by user as malware or phish
- Email reported by user as junk
- A potentially malicious URL click was detected
- A user clicked through to a potentially malicious URL
Access is based on the user’s assigned Email & collaboration content: Emails associated with alerts permission.
[Action required and recommendations]
Ensure that users who need to preview and download emails associated with these four alerts have the required Email & collaboration content: Emails associated with alerts permission.
Learn more
[Compliance considerations]
No compliance considerations identified. Review as usual for your organization.
Additional details from Microsoft
- Summary
- Microsoft Defender has expanded Unified role-based access control (URBAC) permissions for email content access to include alerts related to potentially malicious URL clicks. Security analysts with the appropriate permission can now preview and download emails from four alert types, ensuring consistent access across scenarios.