Merge pull request #278467 from dcurwin/wi-265480-owner-role-june17-2024

Add note about Owner role

Author: prmerger-automator[bot]

articles/defender-for-cloud/permissions.md

@@ -1,6 +1,6 @@
 ---
 title: User roles and permissions
-description: This article explains how Microsoft Defender for Cloud uses role-based access control to assign permissions to users and identify the permitted actions for each role.
+description: Learn how Microsoft Defender for Cloud uses role-based access control to assign permissions to users and identify the permitted actions for each role.
 ms.topic: limits-and-quotas
 ms.date: 05/12/2024
 ---
@@ -25,7 +25,7 @@ The following table displays roles and allowed actions in Defender for Cloud.
 | **Action**   | [Security Reader](../role-based-access-control/built-in-roles.md#security-reader) /<br> [Reader](../role-based-access-control/built-in-roles.md#reader) | [Security Admin](../role-based-access-control/built-in-roles.md#security-admin) | [Contributor](../role-based-access-control/built-in-roles.md#contributor) / [Owner](../role-based-access-control/built-in-roles.md#owner) | [Contributor](../role-based-access-control/built-in-roles.md#contributor) | [Owner](../role-based-access-control/built-in-roles.md#owner) |
 |:-|:-:|:-:|:-:|:-:|:-:|
 |  |  |  | **(Resource group level)** | **(Subscription level)** | **(Subscription level)** |
-| Add/assign initiatives (including) regulatory compliance standards) | - | ✔ | - | - | ✔ |
+| Add/assign initiatives (including regulatory compliance standards) | - | ✔ | - | - | ✔ |
 | Edit security policy | - | ✔ | - | - | ✔ |
 | Enable / disable Microsoft Defender plans | - | ✔ | - | ✔ | ✔ |
 | Dismiss alerts | - | ✔ | - | ✔ | ✔ |
@@ -34,6 +34,9 @@ The following table displays roles and allowed actions in Defender for Cloud.
 | Exempt security recommendations | - |✔|-|-| ✔ |
 | Configure email notifications | - | ✔ | ✔| ✔ | ✔ |
 
+> [!NOTE]
+> While the three roles mentioned are sufficient for enabling and disabling Defender plans, to enable all capabilities of a plan the Owner role is required.
+
 The specific role required to deploy monitoring components depends on the extension you're deploying. Learn more about [monitoring components](monitoring-components.md).
 
 ## Roles used to automatically provision agents and extensions