Microsoft Defender XDR

Manage Rbac

16 October 2026Doc update+8 / −1 lines

In brief

The page adds two reference links, refreshes the Microsoft Sentinel table entry, and adds a sample two-column table.

What Defender admins need to know

No administrator action is indicated; review the updated page when using its RBAC guidance.

Summaries are generated from the documentation change itself.

Documentation change

View full page diff

View on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

| Microsoft Defender for Cloud | Support access management for all Defender for Cloud data that is available in Microsoft Defender portal. | | Microsoft Security Exposure Management | Full support for all Exposure Management data and actions, including Microsoft Secure Score data. | | Microsoft Defender for Cloud Apps (Preview) | Note: Once Unified RBAC is activated, some built-in scoped roles will no longer be supported. For more information, see Map Microsoft Defender for Cloud Apps permissions to the Microsoft Defender unified RBAC permissions. | | Microsoft Sentinel | Supports unified access management for all Microsoft Sentinel workspaces onboarded to the Defender portal. Sentinel role assignments made in Unified RBAC sync with Azure RBAC and are visible there. However, unified RBAC becomes the source of permissions once enabled. When activating Sentinel in Unified RBAC, the User Access Administrator role is assigned to the MTP Unified RBAC app within the enabled workspace.Assigning permissions to a ~~service principal or to a~~ GDAP user group in Microsoft Sentinel is supported in unified RBAC. For more information, see Activate Microsoft Defender unified RBAC.Assigning permissions to a service principal isn't supported in unified RBAC. If you need ~~either~~this capability, keep using Azure RBAC for Microsoft Sentinel. For more information, see Activate Microsoft Defender unified RBAC. Sentinel experiences in the Defender portal continue to respect ARM roles and permissions in addition to URBAC. Therefore, users with more permissions in ARM than in URBAC may see more data in the Sentinel pages in the Defender portal than configured in their URBAC permissions. Supports permission management for the Microsoft Sentinel data lake default workspace, when Microsoft Sentinel is onboarded to both the Defender portal and the Microsoft Sentinel data lake. Microsoft Sentinel users with built-in Azure RBAC roles for their workspaces receive parallel permissions in the Microsoft Sentinel data lake experiences, such as the lake explorer and notebooks. For more information, see Roles and permissions for the Microsoft Sentinel data lake. For row-level access to Sentinel data by using reusable scope tags, see Configure Microsoft Sentinel scoping. To see which roles are supported, check the unified RBAC roles mapping. |

Header 1	Header 2
Cell 1	Cell 2
Cell 3	Cell 4

Note

@@ -38,9 +38,11 @@ item_type: Content source_path: defender-xdr/manage-rbac.md cmProducts: - https://microsoft-devrel.poolparty.biz/DevRelOfferingOntology/c671beaa-a830-4c9f-aceb-97379ee031ca+- https://authoring-docs-microsoft.poolparty.biz/devrel/fcc3cd4a-59ea-47a2-9cc1-784142a5a25d - https://authoring-docs-microsoft.poolparty.biz/devrel/8a94907f-2511-4271-b5ca-ec7f2e75067c spProducts: - https://microsoft-devrel.poolparty.biz/DevRelOfferingOntology/8921374c-4dbe-4ed0-b011-a39e18bfbd98+- https://authoring-docs-microsoft.poolparty.biz/devrel/d7a55faf-a992-4e27-aa3a-eadc9830e778 - https://authoring-docs-microsoft.poolparty.biz/devrel/bffa8e88-f633-409d-a24d-083bdbc68872 platformId: 017c3947-c12b-57c7-78e3-e49580098012 ---@@ -83,7 +85,12 @@ Centralized permissions management is supported for the following services: | **Microsoft Defender for Cloud** | Support access management for all Defender for Cloud data that is available in Microsoft Defender portal. |
 | **Microsoft Security Exposure Management** | Full support for all Exposure Management data and actions, including Microsoft Secure Score data. |
 | **Microsoft Defender for Cloud Apps (Preview)** | **Note:** Once Unified RBAC is activated, some built-in scoped roles will no longer be supported. For more information, see [Map Microsoft Defender for Cloud Apps permissions to the Microsoft Defender unified RBAC permissions](compare-rbac-roles#microsoft-defender-for-cloud-apps). |
-| **Microsoft Sentinel** | Supports unified access management for all Microsoft Sentinel workspaces onboarded to the Defender portal. Sentinel role assignments made in Unified RBAC sync with Azure RBAC and are visible there. However, unified RBAC becomes the source of permissions once enabled. When activating Sentinel in Unified RBAC, the *User Access Administrator* role is assigned to the MTP Unified RBAC app within the enabled workspace.Assigning permissions to a service principal or to a GDAP user group in Microsoft Sentinel isn't supported in unified RBAC. If you need either capability, keep using Azure RBAC for Microsoft Sentinel. For more information, see [Activate Microsoft Defender unified RBAC](activate-defender-rbac). Sentinel experiences in the Defender portal continue to respect ARM roles and permissions in addition to URBAC. Therefore, users with more permissions in ARM than in URBAC may see more data in the Sentinel pages in the Defender portal than configured in their URBAC permissions. Supports permission management for the Microsoft Sentinel data lake default workspace, when Microsoft Sentinel is onboarded to both the Defender portal and the Microsoft Sentinel data lake. Microsoft Sentinel users with built-in Azure RBAC roles for their workspaces receive parallel permissions in the Microsoft Sentinel data lake experiences, such as the lake explorer and notebooks. For more information, see [Roles and permissions for the Microsoft Sentinel data lake](/en-us/azure/sentinel/roles#roles-and-permissions-for-the-microsoft-sentinel-data-lake). For row-level access to Sentinel data by using reusable scope tags, see [Configure Microsoft Sentinel scoping](scoping). To see which roles are supported, check the [unified RBAC roles mapping](compare-rbac-roles#microsoft-sentinel). |
+| **Microsoft Sentinel** | Supports unified access management for all Microsoft Sentinel workspaces onboarded to the Defender portal. Sentinel role assignments made in Unified RBAC sync with Azure RBAC and are visible there. However, unified RBAC becomes the source of permissions once enabled. When activating Sentinel in Unified RBAC, the *User Access Administrator* role is assigned to the MTP Unified RBAC app within the enabled workspace.Assigning permissions to a GDAP user group in Microsoft Sentinel is supported in unified RBAC. For more information, see [Activate Microsoft Defender unified RBAC](activate-defender-rbac).Assigning permissions to a service principal isn't supported in unified RBAC. If you need this capability, keep using Azure RBAC for Microsoft Sentinel. For more information, see [Activate Microsoft Defender unified RBAC](activate-defender-rbac). Sentinel experiences in the Defender portal continue to respect ARM roles and permissions in addition to URBAC. Therefore, users with more permissions in ARM than in URBAC may see more data in the Sentinel pages in the Defender portal than configured in their URBAC permissions. Supports permission management for the Microsoft Sentinel data lake default workspace, when Microsoft Sentinel is onboarded to both the Defender portal and the Microsoft Sentinel data lake. Microsoft Sentinel users with built-in Azure RBAC roles for their workspaces receive parallel permissions in the Microsoft Sentinel data lake experiences, such as the lake explorer and notebooks. For more information, see [Roles and permissions for the Microsoft Sentinel data lake](/en-us/azure/sentinel/roles#roles-and-permissions-for-the-microsoft-sentinel-data-lake). For row-level access to Sentinel data by using reusable scope tags, see [Configure Microsoft Sentinel scoping](scoping). To see which roles are supported, check the [unified RBAC roles mapping](compare-rbac-roles#microsoft-sentinel). |
+
+| Header 1 | Header 2 |
+| --- | --- |
+| Cell 1 | Cell 2 |
+| Cell 3 | Cell 4 |
 
 Note