You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: ATPDocs/role-groups.md
+7-2Lines changed: 7 additions & 2 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -15,6 +15,9 @@ Users that are already [Global Administrators](/entra/identity/role-based-access
15
15
16
16
For other users, enable and use Microsoft 365 role-based access control (RBAC) to create custom roles and to support more Entra ID roles such as Security operator or Security Reader by default to manage access to Defender for Identity.
17
17
18
+
> [!IMPORTANT]
19
+
>Starting March 2, 2025, new Microsoft Defender for Identity tenants can only configure permissions through Microsoft Defender XDR [Unified Role-Based Access Control (RBAC)](/defender-xdr/manage-rbac). Tenants with roles assigned or exported before this date will retain their current configuration.
20
+
18
21
When creating your custom roles, make sure that you apply the permissions listed in the following table:
19
22
20
23
|Defender for Identity access level | Minimum required Microsoft 365 unified RBAC permissions |
@@ -41,15 +44,17 @@ The following table details the specific permissions required for Defender for I
41
44
| ------------------- | ---------------------- |
42
45
|**Onboard Defender for Identity** (create workspace) |[Security Administrator](/entra/identity/role-based-access-control/permissions-reference)|
43
46
|**Configure Defender for Identity settings**| One of the following Microsoft Entra roles:<br>- [Security Administrator](/entra/identity/role-based-access-control/permissions-reference)<br>- [Security Operator](/entra/identity/role-based-access-control/permissions-reference)<br> **Or** <br>The following [Unified RBAC permissions](#unified-role-based-access-control-rbac):<br />- `Authorization and settings/Security settings/Read`<br/>- `Authorization and settings/Security settings/All permissions`<br/>- `Authorization and settings/System settings/Read`<br/>- `Authorization and settings/System settings/All permissions`|
44
-
|**View Defender for Identity settings**|One of the following Microsoft Entra roles:<br>- [Global Reader](/entra/identity/role-based-access-control/permissions-reference)<br>- [Security Reader](/entra/identity/role-based-access-control/permissions-reference) <br> **Or** <br>The following [Unified RBAC permissions](#unified-role-based-access-control-rbac):<br />- `Authorization and settings/Security settings/Read` <br/>- `Authorization and settings/System settings/Read`|
47
+
|**View Defender for Identity settings**| Microsoft Entra roles:<br>- [Security Reader](/entra/identity/role-based-access-control/permissions-reference) <br> **Or** <br>The following [Unified RBAC permissions](#unified-role-based-access-control-rbac):<br />- `Authorization and settings/Security settings/Read` <br/>- `Authorization and settings/System settings/Read`|
45
48
|**Manage Defender for Identity security alerts and activities**| One of the following Microsoft Entra roles:<br>- [Security Operator](/entra/identity/role-based-access-control/permissions-reference)<br> **Or** <br>The following [Unified RBAC permissions](#unified-role-based-access-control-rbac):<br />- `Security operations/Security data/Alerts (Manage)`<br/>- `Security operations/Security data /Security data basics (Read)`|
46
49
|**View Defender for Identity security assessments** <br> (now part of Microsoft Secure Score) |[Permissions](/microsoft-365/security/defender/microsoft-secure-score#required-permissions) to access Microsoft Secure Score <br> **And** <br> The following [Unified RBAC permissions](#unified-role-based-access-control-rbac): `Security operations/Security data /Security data basics (Read)`|
47
50
|**View the Assets / Identities page**|[Permissions](/defender-cloud-apps/manage-admins) to access Defender for Cloud Apps <br> **Or** <br> One of the Microsoft Entra roles required by [Microsoft Defender XDR](/microsoft-365/security/defender/m365d-permissions)|
48
51
|**Perform Defender for Identity response actions**|A [custom role](/microsoft-365/security/defender/create-custom-rbac-roles) defined with permissions for **Response (manage)**<br> **Or** <br> One of the following Microsoft Entra roles:<br>- [Security Operator](/entra/identity/role-based-access-control/permissions-reference)|
49
52
50
-
51
53
## Defender for Identity security groups
52
54
55
+
> [!IMPORTANT]
56
+
> Starting March 2, Defender for Identity will no longer create Microsoft Entra ID security groups. Tenants can still configure the same permissions through Microsoft Defender XDR [Unified Role-Based Access Control (RBAC)](/defender-xdr/manage-rbac)
57
+
53
58
Defender for Identity provides the following security groups to help manage access to Defender for Identity resources:
Copy file name to clipboardExpand all lines: CloudAppSecurityDocs/app-governance-get-started.md
+6-1Lines changed: 6 additions & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -18,12 +18,17 @@ Before you start, verify that you satisfy the following prerequisites:
18
18
- Microsoft Defender for Cloud Apps must be present in your account as either a standalone product or as part of the various [license](#licensing) packages.
19
19
20
20
If you aren't already a Defender for Cloud Apps customer, you can [sign up for a free trial](https://www.microsoft.com/security/business/cloud-apps-defender).
21
-
21
+
22
22
- You must have [one of the appropriate roles](#roles) to turn on app governance and access it.
23
23
24
24
25
25
- Your organization's billing address must be in a region **other than** Brazil, Singapore, Latin America, South Korea, Switzerland, Norway, Poland, Italy, Qatar, Israel, Spain, Mexico, South Africa, Sweden, or United Arab Emirates.
26
26
27
+
> [!IMPORTANT]
28
+
> Connect to Microsoft 365 connector to get visibility into activities and specific resources accessed by OAuth apps in the Microsoft Defender XDR advanced hunting blade. This will enhance your ability to investigate and respond to certain threat detection policy alerts generated by app governance.
29
+
>
30
+
> Learn how to [connect to the Microsoft 365 connector](/defender-cloud-apps/protect-office-365).
31
+
27
32
## Turn on app governance
28
33
29
34
If your organization satisfies the [prerequisites](#prerequisites), go to [Microsoft Defender XDR > Settings > Cloud Apps > App governance](https://security.microsoft.com/cloudapps/settings) and select **Use app governance**. For example:
Copy file name to clipboardExpand all lines: CloudAppSecurityDocs/release-notes.md
-63Lines changed: 0 additions & 63 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -19,69 +19,6 @@ For more information on what's new with other Microsoft Defender security produc
19
19
20
20
For news about earlier releases, see [Archive of past updates for Microsoft Defender for Cloud Apps](release-note-archive.md).
21
21
22
-
## February 2025
23
-
24
-
### Enhanced Visibility into OAuth Apps Connected to Microsoft 365 - General Availability
25
-
26
-
Defender for Cloud Apps users who use app governance will be able to gain visibility into the origin of OAuth apps connected to Microsoft 365. You can filter and monitor apps that have external origins, to proactively review such apps and improve the security posture of the organization.
27
-
28
-
The new *Permissions filter and export capabilities allow you to quickly identify apps with specific permissions to access Microsoft 365.
29
-
30
-
You can now get granular insights into data accessed by apps using legacy EWS API alongside Microsoft Graph. The enhanced coverage of data usage insights enable you to get deeper visibility into apps accessing emails using legacy EWS API.
31
-
32
-
We're also expanding the coverage of privilege level feature for all popular Microsoft first-party API permissions. The enhanced coverage of privilege level classification enables you to view and monitor apps with powerful permissions into legacy and other non-Graph APIs that have access to Microsoft 365.
33
-
34
-
For more information, see [detailed insights into OAuth apps](/defender-cloud-apps/app-governance-visibility-insights-view-apps#getting-detailed-information-on-an-app).
35
-
36
-
### Enhanced alert source accuracy
37
-
38
-
Microsoft Defender for Cloud Apps is enhancing its alert sources to deliver more precise information. This update, applicable to new alerts only, will be reflected across various experiences and APIs, including the Defender XDR portal, Advanced hunting, and Graph API.
39
-
The goal is to improve the accuracy of alert origins, facilitating better identification, management, and response to alerts.
40
-
41
-
To learn more about the different alert sources in Defender XDR see the _Alert sources_ section of [Investigate alerts in Microsoft Defender XDR - Microsoft Defender XDR | Microsoft Learn](/defender-xdr/investigate-alerts?tabs=settings)
42
-
43
-
To learn more about the Graph API alert resource: [alert resource type - Microsoft Graph v1.0 | Microsoft Learn](/graph/api/resources/security-alert?view=graph-rest-1.0&preserve-view=true)
44
-
45
-
### Network requirement updates
46
-
47
-
Microsoft Defender for Cloud Apps has improved its security and performance. Network information in firewalls and additional third-party services must be updated to comply with the new standards. To ensure uninterrupted access to our portals and services you must apply these changes by March 27, 2025.
48
-
49
-
New CDN domains have been added and must be included in firewall rules to allow outbound traffic on port 443:
50
-
- cdn.cloudappsecurity.com
51
-
- cdn-discovery.cloudappsecurity.com
52
-
53
-
To connect to third-party apps and enable Defender for Cloud Apps, use the following IP addresses:
To stay up to date on IP ranges, it's recommended to refer to the following Azure service tags for Microsoft Defender for Cloud Apps services. The latest IP ranges are found in the service tag. For more information, see [Azure IP ranges](/azure/virtual-network/service-tags-overview).
0 commit comments