MC787370 - Advanced Hunting Permissions update for some Microsoft Defender for Office 365 security admins

We've changed the permissions mechanism to access Email & collaboration schema in Advanced Hunting for Microsoft Defender for Office 365 customers, to align with Threat Explorer.

When this will happen:

We will begin rolling out in early May 2024 and expect to complete by late May 2024.

How this will affect your organization:

Impacted users:

Security teams that are using Defender XDR Email & collaboration schema in Advanced Hunting (https://security.microsoft.com/v2/advanced-hunting)

• Users assigned to Exchange Online Protection role groups View-only Manage alerts, Manage alerts, View-only audit logs, Audit logs, and Organization configuration. These role groups are configured in the Defender portal, under Permissions / Email & collaboration Roles / Roles, or in the Purview compliance portal under Roles and Scopes/Permissions.
• Users assigned the following permissions using Defender XDR Unified RBAC for Microsoft Defender for Office 365:
  • Security operations / Security data basics (read), without Security operations / Raw data / Email & collaboration metadata (read)).

Previously, these roles granted access to Microsoft Defender for Office 365 Alerts and Incidents, as well as Email & collaboration schema in Advanced Hunting.

What you need to do to prepare:

After rolling out this change, these roles will continue to grant access to Microsoft Defender for Office 365 Alerts and Incidents, but not Email & collaboration schema in Advanced Hunting. 

If you are willing to continue and grant your teams access to Email & collaboration schema in Advanced Hunting, please assign them one of the following permissions, same as required to access Threat Explorer:

• If Defender XDR Unified RBAC is active for Email & collaboration: please assign:
  Security operations / Raw data / Email & collaboration metadata (read) permission.
• If Defender XDR Unified RBAC is not active for Email & collaboration, please assign the following Email & collaboration permissions in the Defender portal:
  Security Reader, Security Operator, Security Administrator, Exchange Administrator, Global Reader, View-Only Recipients, Organization Management.

Notes:

• This change does not impact access to Threat Explorer
• Global Entra ID roles are not impacted by this change

Please review the following resources to learn more:

• For additional information on Advanced Hunting permissions, see Custom roles for role-based access control | Microsoft Learn
• For additional information on Threat Explorer permissions, see About Threat Explorer and Real-time detections in Microsoft Defender for Office 365 | Microsoft Learn