Merge pull request #853 from MicrosoftDocs/deniseb-global-admin

Author: denisebmsft

defender-xdr/dex-xdr-permissions.md

@@ -14,7 +14,7 @@ ms.collection:
   - tier1
 ms.topic: conceptual
 search.appverid: met150
-ms.date: 05/29/2023
+ms.date: 06/28/2024
 ---
 
 # How Microsoft Defender Experts for XDR permissions work
@@ -32,6 +32,9 @@ For Microsoft Defender Experts for XDR incident investigations, when our experts
 
 ## Configuring permissions in customer tenants
 
+> [!IMPORTANT]
+> Microsoft recommends that you use roles with the fewest permissions. This helps improve security for your organization. Global Administrator is a highly privileged role that should be limited to emergency scenarios when you can't use an existing role.
+
 Once you select the permissions you'd like to grant to our experts, we create the following policies in your tenant using the Security Administrator or Global Administrator context:
 
 - **Configure Microsoft Experts as a service provider** – This setting lets our experts access the tenant environment as external collaborators without requiring you to create accounts for them.
@@ -44,4 +47,5 @@ These policies are configured during the onboarding process and require the rele
 ### See also
 
 [Important considerations for Microsoft Defender Experts for XDR](additional-information-xdr.md)
+
 [!INCLUDE [Microsoft Defender XDR rebranding](../includes/defender-m3d-techcommunity.md)]

defender-xdr/get-started-xdr.md

@@ -15,7 +15,7 @@ ms.collection:
   - essentials-get-started
 ms.topic: conceptual
 search.appverid: met150
-ms.date: 05/28/2024
+ms.date: 06/28/2024
 ---
 
 # Get started with Microsoft Defender Experts for XDR
@@ -36,6 +36,9 @@ Select the link in the welcome email to directly launch the Defender Experts set
 
 ## Grant permissions to our experts
 
+> [!IMPORTANT]
+> Microsoft recommends that you use roles with the fewest permissions. This helps improve security for your organization. Global Administrator is a highly privileged role that should be limited to emergency scenarios when you can't use an existing role.
+
 By default, Defender Experts for XDR requires **Service provider access** that lets our experts sign into your tenant and deliver services based on assigned security roles. [Learn more about cross-tenant access](/azure/active-directory/external-identities/cross-tenant-access-overview)
 
 You also need to grant our experts one or both of the following permissions:
@@ -53,7 +56,9 @@ You also need to grant our experts one or both of the following permissions:
 **To grant our experts permissions:**
 
 1. In the same Defender Experts settings setup, under **Permissions**, choose the access level(s) you want to grant our experts.
+
 1. If you wish to [exclude device and user groups](#exclude-devices-from-remediation) in your organization from remediation actions, select **Manage exclusions**.
+
 1. Select **Next** to [add contact persons or groups](#tell-us-who-to-contact-for-important-matters).
 
 To edit or update permissions after the initial setup, go to **Settings** > **Defender Experts** > **Permissions**.
@@ -65,12 +70,15 @@ Defender Experts for XDR lets you exclude devices and users from remediation act
 **To exclude device groups:**
 
 1. In the same Defender Experts settings setup, under **Exclusions**, go to the **Device groups** tab.
+
 2. Select **+ Add device groups**, then search for and choose the device group(s) that you wish to exclude.
    > [!NOTE]
    > This page only lists existing device groups. If you wish to create a new device group, you first need to go to the Defender for Endpoint settings in your Microsoft Defender portal. Then, refresh this page to search for and choose the newly created group. [Learn more about creating device groups](/defender-endpoint/machine-groups)
 
 3. Select **Add device groups**.
+
 4. Back on the **Device groups** tab, review the list of excluded device groups. If you wish to remove a device group from the exclusion list, choose it then select **Remove device group**.
+
 5. Select **Next** to confirm your exclusion list and proceed to [adding contact persons or groups](#tell-us-who-to-contact-for-important-matters). Otherwise, select **Skip**, and all your added exclusions are discarded.
 
 :::image type="content" source="/defender/media/xdr/exclude-device-groups.png" alt-text="Screenshot of option to exclude device groups." lightbox="/defender/media/xdr/exclude-device-groups.png":::
@@ -127,9 +135,13 @@ Once identified, the individuals or groups will receive an email notifying them
 **To add notification contacts:**
 
 1. In the same Defender Experts settings setup, under **Contacts**, search for and add your **Contact person or team** in the text field provided.
+
 2. Add a **Phone number** (optional) that Defender Experts can call for matters that require immediate attention.
+
 3. Under the **Contact for** dropdown box, choose **Incident notification** or **Service review**.
+
 4. Select **Add**.
+
 1. Select **Next** to confirm your contacts list and proceed to [creating a Teams channel](#receive-managed-response-notifications-and-updates-in-microsoft-teams) where you can also receive incident notifications.
 
 To edit or update your notification contacts after the initial setup, go to **Settings** > **Defender Experts** > **Notification contacts**.
@@ -146,8 +158,11 @@ Apart from email and [in-portal chat](communicate-defender-experts-xdr.md#in-por
 **To turn on Teams notifications and chat:**
 
 1. In the same Defender Experts settings setup, under **Teams**, select the **Communicate on Teams** checkbox.  
+
 2. Select **Next** to review your settings.
+
 3. Select **Submit**. The step-by-step guide then completes the initial setup.
+
 4. Select **View readiness assessment** to complete the necessary actions required to [optimize your security posture](#prepare-your-environment-for-the-defender-experts-service).
 
 > [!NOTE]

defender-xdr/import-rbac-roles.md

@@ -12,7 +12,7 @@ ms.collection:
 - tier3
 ms.custom: 
 ms.topic: how-to
-ms.date: 06/13/2024
+ms.date: 06/28/2024
 ms.reviewer: 
 search.appverid: met150
 ---
@@ -45,16 +45,22 @@ The following steps guide you on how to import roles into Microsoft Defender XDR
 
 > [!IMPORTANT]
 > You must be a Global Administrator or Security Administrator in Microsoft Entra ID, or have all the **Authorization** permissions assigned in Microsoft Defender XDR Unified RBAC to perform this task. For more information on permissions, see [Permission pre-requisites](manage-rbac.md#permissions-prerequisites).
+> Microsoft recommends that you use roles with the fewest permissions. This helps improve security for your organization. Global Administrator is a highly privileged role that should be limited to emergency scenarios when you can't use an existing role.
 
 1. Sign in to the [Microsoft Defender portal](https://security.microsoft.com).
+
 2. In the navigation pane, select **Permissions**.
+
 3. Select **Roles** under Microsoft Defender XDR to get to the Permissions and roles page.
+
 4. Select **Import role**.
+
 5. Select the products you want to import roles from.
 
     :::image type="content" source="/defender/media/defender/m365-defender-import-workloads.png" alt-text="Screenshot of the import workloads page" lightbox="/defender/media/defender/m365-defender-import-workloads.png":::
 
 6. Select **Next** to choose the roles to import. You can choose all roles or select specific roles from the list. Select the role name to review the permissions and assigned users or groups for that specific role.
+
 7. Select the roles you want to import and select **Next**.
 
 > [!NOTE]
@@ -63,6 +69,7 @@ The following steps guide you on how to import roles into Microsoft Defender XDR
 > To import this role to Unified RBAC, remove the user or user group from the role in the original RBAC model. Select the role to view the list of users that still exist for that role to determine which user or group to remove.
 
 8. Select **Submit**.
+
 9. Select **Done** on the confirmation page.
 
 Now that you have imported your roles you will be able to [View and edit roles](edit-delete-rbac-roles.md) and activate the workloads.
@@ -78,5 +85,6 @@ Imported roles appear in the **Permissions and roles** list together with any cu
 
 - [Activate Microsoft Defender XDR Unified RBAC](activate-defender-rbac.md)
 - [Edit or delete roles](edit-delete-rbac-roles.md)
+
 [!INCLUDE [Microsoft Defender XDR rebranding](../includes/defender-m3d-techcommunity.md)]