Hey everyone, diving into a pretty common but tricky operational hurdle we've hit while rolling out Defender for Endpoint across more teams.
We're deep in a product-led growth phase for our internal tools, and I'm the primary "owner" in the portal. I need to delegate daily operational tasks—like checking and triaging alerts, reviewing threat analytics, maybe adjusting device tags—to other team members. However, I absolutely cannot give them full global administrator access to our Microsoft 365 tenant or even the Security admin role. That's just asking for trouble from both a security and an audit perspective.
I've been poking around the Azure Active Directory roles and the specific roles within the Microsoft 365 Defender portal itself, and it feels like there's a gap? Or more likely, I'm missing the correct recipe.
Here's what I'm trying to enable for a few trusted analysts:
* View and manage all security alerts and incidents within Defender for Endpoint.
* Access the security portal and see the full device inventory, with ability to tag or create device groups.
* Run scans, initiate automated investigations, or apply remediation actions on endpoints.
* **Crucially, NOT have:** Access to other compliance centers, the ability to modify tenant-wide settings, or manage users/licenses.
I started with the built-in "Security Operator" role, but it felt a bit too limited. Then looked at "Security Administrator," but that one seems to spill over into other areas like Identity Protection and potentially grants more than I want for Endpoint specifically.
Has anyone successfully built a granular, least-privilege model for Defender for Endpoint operations? I'm particularly curious about:
* The real-world difference in day-to-day tasks between "Security Operator" and "Security Administrator" in *pure Endpoint contexts*.
* Whether creating a custom Azure AD role is the only way to get this perfect fit, and if so, what specific **Microsoft Defender for Endpoint** RBAC permissions you included.
* Any gotchas—like certain critical actions in the portal that silently require a higher privilege than you'd expect, breaking the workflow.
I'm planning to experiment in our dev tenant, but would love to borrow from your experiences before I start. The goal is to enable the team without creating a security incident ourselves!
Try everything, keep what works.
Oh, I just ran into this last week! You're looking for the "Defender for Endpoint" roles specifically, not the general Azure AD ones.
There's a role called "Security Operator" in the Defender portal that lets people do exactly what you listed. They can handle alerts, tag devices, and run actions without touching admin settings. I gave it to our junior analyst and it worked great.
Have you checked the permissions under "Roles & groups" in the Microsoft 365 Defender portal directly? That's where I found the granular options.
Thanks!
The Security Operator role is a good starting point, but its permissions are quite broad. While it doesn't grant tenant admin, it does allow the holder to take remediation actions across devices, which is a significant control.
For true least-privilege delegation, you need to go a step further into role groups. You can create custom role groups under "Permissions" in the Defender portal. This lets you strip out specific high-impact actions, like initiating an automated investigation or approving a pending remediation, while keeping alert triage and device tagging. The built-in roles are pre-packaged compromises.
The granularity is there, but you have to map the 30+ distinct permissions in the matrix to your actual operational needs. I usually document which custom permissions map to each of our defined SOC tier 1 tasks before creating the group.