What and why:
Microsoft Defender Unified RBAC (URBAC) is becoming the
single access model for all Defender and Sentinel portal experiences. Your
tenant will be auto enabled to URBAC.
Unified RBAC will be activated automatically for the in-scope workload(s)
on your tenant following a notification period that begins when you receive the
in-portal notification, and your roles are imported into Unified RBAC.
Activation is expected to occur approximately 30 days after that notification
date.
Unified RBAC offer more extended access management
capabilities, including:
- A single
access management system to manage all roles and permissions across
all workloads
- Scoping
capabilities such
as Cloud, Sentinel, Identity, and Device Groups.
- Future-proof
assignments
that will allow you to include future permissions and workloads
This change
applies exclusively to Microsoft Defender. Permissions for Microsoft
Purview, Exchange Online, Microsoft Entra directory roles, Privileged Identity
Management, and Azure resources (not related to Microsoft Sentinel) remain
unchanged. In addition, if you are using Powershell with Microsoft Defender for
Office 365, this will continue to work as is.
Rollout Schedule:
Global: We will begin rolling out on late September 2026 and expect to complete by late December 2026.
Impact on your organization:
What you will see:
- Notification banner: A notification will be displayed in
the Microsoft Defender portal informing customers that the specified
workload(s) will transition to Unified RBAC. Legacy RBAC roles are
automatically imported into Unified RBAC. This date marks the beginning of
the customer notification period before automatic activation
- Activation
date: Beginning approximately
30 days after the notification date, Unified RBAC will be automatically
enabled for the specified workload(s). Customers can review imported role
assignments and prepare for the transition during this period.
- The
in-portal banner in the Microsoft Defender portal (‘Permissions and roles’
page) will confirm activation.
How this will affect your organization:
- Your existing roles, if
applicable, will be auto-imported into Unified RBAC. Because Unified RBAC is not yet active on your tenant for the
workloads indicated, this import has no operational impact until
activation. You may review and adjust the imported roles at any time from
the Microsoft Defender portal. You may also re-run the import manually.
Existing roles and permissions are mapped to Unified RBAC using a mapping
logic. For more information on this mapping, please see here.
- At the end of the notification
period, Unified RBAC will be activated automatically for the in-scope workload(s). After activation, authorization
for Defender/Sentinel portal experiences defaults to Unified RBAC roles;
legacy RBAC assignments are no longer required to operate those portal
experiences.
- Opt-out: Self-service opt-out is
available after activation. Go to the ‘workload settings’ control in
Unified RBAC to instantly revert to your legacy RBAC system if needed.
- If
you are using APIs to configure your roles and permissions, please transfer to using the new
Unified RBAC API
- Delegated
access (B2B/GDAP) or Multi-Tenant Management: remains unchanged. Roles that
had assignments to B2B/GDAP users/groups will be included in the automatic
import.
- Entra
directory roles are unchanged. Global Administrator, Security Administrator,
Security Operator, and Security Reader continue to grant access to the
Microsoft Defender portal as they do today. These roles will now map to
Unified RBAC permissions as per the mapping referenced earlier. For more information on this mapping, please see here.
- Azure RBAC continues to govern Azure
resources, including Logic Apps and Workbooks.
Microsoft Sentinel specific workspace permissions (Sentinel Reader,
Responder, Contributor roles) do get auto-enabled to Unified RBAC.
- Email and Collaboration
permissions and Exchange Online permissions continue to govern Exchange Online and Microsoft Purview scenarios.
They are no longer required to operate Microsoft Defender for Office 365
portal experiences once Unified RBAC is active.
Action Required / Recommendations: