Microsoft Defender for Cloud Apps
Cloud and workloadsManage Admins
In brief
App/instance admin and User group admin role assignments can no longer be used in new configurations. Existing configurations remain supported.
What Defender admins need to know
No action is required for existing assignments. Organizations needing these capabilities should contact Microsoft Support.
Summaries are generated from the documentation change itself.
Documentation change
View on Microsoft LearnThe comparison below shows only the changed extract. Use the full-page view for complete context.
ms.service: defender-for-cloud-apps
ms.suite: ems
description: Set up role-based administrator access in Defender for Cloud Apps and understand how Microsoft Entra ID and Microsoft 365 roles affect permissions.
ms.date: 2026-07-03T00:10-04T00:00:00.0000000Z
ms.topic: how-to
ms.reviewer: Naama-Goldbart
ms.custom:
| Cloud Discovery global admin | Has permission to view and edit all cloud discovery settings and data. The Global Discovery admin has the following access:
- Settings: System settings - View only; Cloud Discovery settings - View and edit all (anonymization permissions depend on whether it was allowed during role assignment)
- Cloud discovery activity - full permissions
- Alerts - view and manage only alerts related to the relevant cloud discovery report
- Policies - Can view all policies and can edit or create only cloud discovery policies
- Activities page - No permissions
- Accounts page - No permissions
- App permissions – No permissions
- Files page – No permissions
- Conditional access app control - No permissions
- Security extensions - Creating and deleting their own API tokens
- Governance actions - Only Cloud Discovery related actions
- Security recommendations for cloud platforms - No permissions
- IP ranges - No permissions |
| Cloud Discovery report admin | - Settings: System settings - View only; Cloud discovery settings - View all (anonymization permissions depend on whether it was allowed during role assignment)
- Cloud discovery activity - read permissions only
- Alerts – view only alerts related to the relevant cloud discovery report
- Policies - Can view all policies and can create only cloud discovery policies, without the possibility to govern application (tagging, sanction and unsanctioned)
- Activities page - No permissions
- Accounts page - No permissions
- App permissions – No permissions
- Files page – No permissions
- Conditional access app control - No permissions
- Security extensions - Creating and deleting their own API tokens
- Governance actions – view only actions related to the relevant cloud discovery report
- Security recommendations for cloud platforms - No permissions
- IP ranges - No permissions |
Note
The App/instance admin and User group admin role assignments are no longer available for new configurations as part of platform consolidation efforts. Existing configurations aren't affected and continue to be supported. If your organization requires these capabilities, contact Microsoft Support.
Important
Microsoft recommends that you use roles with the fewest permissions. Using least-privilege roles helps improve security for your organization. Global Administrator is a highly privileged role that should be limited to emergency scenarios when you can't use an existing role.
@@ -13,7 +13,7 @@ ms.collection: M365-security-compliance ms.service: defender-for-cloud-apps ms.suite: ems description: Set up role-based administrator access in Defender for Cloud Apps and understand how Microsoft Entra ID and Microsoft 365 roles affect permissions.-ms.date: 2026-07-03T00:00:00.0000000Z+ms.date: 2026-10-04T00:00:00.0000000Z ms.topic: how-to ms.reviewer: Naama-Goldbart ms.custom:@@ -123,6 +123,10 @@ The following specific admin roles can be configured in the Microsoft Defender p | **Cloud Discovery global admin** | Has permission to view and edit all cloud discovery settings and data. The Global Discovery admin has the following access: <br>- Settings: System settings - View only; Cloud Discovery settings - View and edit all (anonymization permissions depend on whether it was allowed during role assignment)<br>- Cloud discovery activity - full permissions<br>- Alerts - view and manage only alerts related to the relevant cloud discovery report<br>- Policies - Can view all policies and can edit or create only cloud discovery policies<br>- Activities page - No permissions<br>- Accounts page - No permissions<br>- App permissions – No permissions<br>- Files page – No permissions<br>- Conditional access app control - No permissions<br>- Security extensions - Creating and deleting their own API tokens<br>- Governance actions - Only Cloud Discovery related actions<br>- Security recommendations for cloud platforms - No permissions<br>- IP ranges - No permissions |
| **Cloud Discovery report admin** | - Settings: System settings - View only; Cloud discovery settings - View all (anonymization permissions depend on whether it was allowed during role assignment)<br>- Cloud discovery activity - read permissions only<br>- Alerts – view only alerts related to the relevant cloud discovery report<br>- Policies - Can view all policies and can create only cloud discovery policies, without the possibility to govern application (tagging, sanction and unsanctioned)<br>- Activities page - No permissions<br>- Accounts page - No permissions<br>- App permissions – No permissions<br>- Files page – No permissions<br>- Conditional access app control - No permissions<br>- Security extensions - Creating and deleting their own API tokens<br>- Governance actions – view only actions related to the relevant cloud discovery report<br>- Security recommendations for cloud platforms - No permissions<br>- IP ranges - No permissions |
+Note
+
+The **App/instance admin** and **User group admin** role assignments are no longer available for new configurations as part of platform consolidation efforts. Existing configurations aren't affected and continue to be supported. If your organization requires these capabilities, contact Microsoft Support.
+
Important
Microsoft recommends that you use roles with the fewest permissions. Using least-privilege roles helps improve security for your organization. Global Administrator is a highly privileged role that should be limited to emergency scenarios when you can't use an existing role.