What and why
We’re expanding Unified role-based access control (URBAC) permission support for Email & collaboration content: Emails associated with alerts in Microsoft Defender. This change provides more consistent email content access across alert investigation scenarios based on a user’s assigned permissions.
Previously, this permission applied to:
- Email reported by user as malware or phish
- Email reported by user as junk
With this rollout, the permission will also apply to:
- A potentially malicious URL click was detected
- A user clicked through to a potentially malicious URL
Rollout schedule
General Availability (Worldwide): Available now
Impact on your organization
Who is affected
- Security analysts who preview or download emails associated with the affected alerts
Platforms and services
What will happen
Security analysts with the required permission will be able to preview and download emails associated with these four alerts:
- Email reported by user as malware or phish
- Email reported by user as junk
- A potentially malicious URL click was detected
- A user clicked through to a potentially malicious URL
Access is based on the user’s assigned Email & collaboration content: Emails associated with alerts permission.
Action required and recommendations
Ensure that users who need to preview and download emails associated with these four alerts have the required Email & collaboration content: Emails associated with alerts permission.
Learn more
Compliance considerations
No compliance considerations identified. Review as usual for your organization.