adding new roles

Author: batamig

articles/sentinel/roles.md

@@ -27,7 +27,6 @@ Use Azure RBAC to create and assign roles within your security operations team t
 
 Grant the appropriate access to the data in your workspace by using built-in roles. You might need to grant more roles or specific permissions depending on a user's job tasks.
 
-
 ### Microsoft Sentinel-specific roles
 
 All Microsoft Sentinel built-in roles grant read access to the data in your Microsoft Sentinel workspace.
@@ -50,6 +49,10 @@ As another option, assign the roles directly to the Microsoft Sentinel **workspa
 
 Users with particular job requirements might need to be assigned other roles or specific permissions in order to accomplish their tasks.
 
+- **Connect data sources to Microsoft Sentinel**
+
+    For a user to add data connectors, you must assign the user **Write** permissions on the Microsoft Sentinel workspace. Notice the required extra permissions for each connector, as listed on the relevant connector page.
+
 - **Install and manage out-of-the-box content**
 
     Find packaged solutions for end-to-end products or standalone content from the content hub in Microsoft Sentinel. To install and manage content from the content hub, assign the **Microsoft Sentinel Contributor** role at the resource group level.
@@ -64,10 +67,6 @@ Users with particular job requirements might need to be assigned other roles or
 
     For an automation rule to run a playbook, this account must be granted explicit permissions to the resource group where the playbook resides. At that point, any automation rule can run any playbook in that resource group. To grant these permissions to this service account, your account must have **Owner** permissions to the resource groups containing the playbooks.
 
-- **Connect data sources to Microsoft Sentinel**
-
-    For a user to add data connectors, you must assign the user **Write** permissions on the Microsoft Sentinel workspace. Notice the required extra permissions for each connector, as listed on the relevant connector page.
-
 - **Allow guest users to assign incidents**
 
     If a guest user needs to be able to assign incidents, you need to assign the [**Directory Reader**](../active-directory/roles/permissions-reference.md#directory-readers) role to the user, in addition to the **Microsoft Sentinel Responder** role. The Directory Reader role isn't an Azure role but a Microsoft Entra role, and regular (nonguest) users have this role assigned by default.
@@ -126,7 +125,7 @@ After understanding how roles and permissions work in Microsoft Sentinel, you ca
 |     | [Logic Apps Contributor](../role-based-access-control/built-in-roles.md#logic-app-contributor)        | Microsoft Sentinel's resource group, or the resource group where your playbooks are stored        | Attach playbooks to analytics and automation rules. <br>Run and modify playbooks.         |
 |  **Service Principal**   | [Microsoft Sentinel Contributor](../role-based-access-control/built-in-roles.md#microsoft-sentinel-contributor)      |  Microsoft Sentinel's resource group       | Automated configuration for management tasks |
 
-More roles might be required depending on the data you ingest or monitor. For example, Microsoft Entra roles might be required, such as the Security Administrator role, to set up data connectors for services in other Microsoft portals.
+More roles might be required depending on the data you ingest or monitor. For example, Microsoft Entra roles might be required, such as the Security Administrator role, to [manage multiple workspaces](workspaces-defender-portal.md#permissions-to-manage-workspaces-and-view-workspace-data), or to set up data connectors for services in other Microsoft portals.
 
 ## Resource-based access control
 

articles/sentinel/workspaces-defender-portal.md

@@ -50,18 +50,27 @@ If you have the appropriate permissions to view data from primary and secondary
 |**Microsoft Sentinel** experiences|View data from one workspace for each page in the Microsoft Sentinel section of the Defender portal. Switch between workspaces by selecting **Select a workspace** from the top-right hand side of the browser for most pages. The **Workbooks** page only shows data associated with the primary workspace.|
 |**SOC optimization**|Data and recommendations are aggregated from multiple workspaces. |
 
+## Permissions to manage workspaces and view workspace data
 
-## Permissions to view workspace data
+Use one of the following roles or role combinations to manage primary and secondary workspaces:
 
-After you connect Microsoft Sentinel to the Defender portal, your existing Azure role-based access control (RBAC) permissions allow you to view and work with the Microsoft Sentinel features and workspaces that you have access to.
+|Task  |Required roles or role combinations  |
+|---------|---------|
+|**Connect a primary workspace**     | One of the following: <br>- Global Administrator <br>- Security Administrator + subscription Owner <br>- Security Administrator + User access administrator + Sentinel contributor      |
+|**Select a different primary workspace**     | One of the following: <br>- Global Administrator <br>- Security Administrator      |
+|**Onboard or offboard secondary workspaces**     |  One of the following: <br>- Global Administrator <br>- Security Administrator <br>- Security Administrator + subscription Owner <br>- Security Administrator + User access administrator + Sentinel contributor <br>- Subscription Owner + Sentinel contributor <br>- User access administrator + Sentinel contributor        |
 
+> [!IMPORTANT]
+> Microsoft recommends that you use roles with the fewest permissions. This helps improve security for your organization. Global Administrator is a highly privileged role that should be limited to emergency scenarios when you can't use an existing role.
+
+After you connect Microsoft Sentinel to the Defender portal, your existing Azure role-based access control (RBAC) permissions allow you to view and work with the Microsoft Sentinel features and workspaces that you have access to.
 
 |Workspace |Access  |
 |---------|---------|
-|Primary    | If you have access to the primary workspace, you're able to read and manage data from the workspace and Defender XDR.      |
-|Secondary    |   If you have access to a secondary workspace, you're able to read and manage data from the workspace only. The secondary workspaces don't include Defender XDR data.       |
+|**Primary**    | If you have access to the primary workspace, you're able to read and manage data from the workspace and Defender XDR.      |
+|**Secondary**    |   If you have access to a secondary workspace, you're able to read and manage data from the workspace only. The secondary workspaces don't include Defender XDR data.       |
 
-**Exception:** If you've already onboarded one workspace to the Defender portal,  any alerts created by using custom detections on `AlertInfo` and `AlertEvidance` tables before mid January are visible to all users.
+**Exception:** If you've already onboarded one workspace to the Defender portal, any alerts created by using custom detections on `AlertInfo` and `AlertEvidence` tables before mid January 2025 are visible to all users.
 
 For more information, see [Roles and permissions in Microsoft Sentinel](roles.md).