7.2 Managing Permissions for Defender XDR, Purview & Workloads

Managing Permissions for Microsoft Defender XDR, Purview & Workloads

Microsoft 365 workloads each expose their own permission model. MS-102 expects you to know which model each workload uses, where the role groups live, and how Microsoft is converging these into a unified RBAC experience accessible from the Defender and Purview portals.

Per-Workload Permission Models

Microsoft Defender XDR Permissions

Microsoft Defender XDR primarily relies on Entra ID roles for top-level access. The built-in roles most commonly assigned are Security Administrator, Security Operator, and Security Reader. Security Administrator can configure policies across Defender for Endpoint, Defender for Office 365, Defender for Identity, and Defender for Cloud Apps; Security Operator can respond to active incidents and take approved remediation actions; Security Reader has read-only visibility into alerts, incidents, and recommendations.

For finer-grained control, Defender XDR supports custom RBAC roles configured directly in the Microsoft Defender portal under Settings → Permissions → Endpoints → Roles. A custom Defender role can grant, for example, "live response" capability without granting full Security Administrator. These custom roles are separate from Entra custom roles and are scoped to the Defender XDR data plane (device groups are one common scoping mechanism).

Microsoft Sentinel, when used alongside Defender XDR, has its own Entra roles — Sentinel Contributor, Sentinel Reader, and Sentinel Responder — plus resource-scope RBAC at the Log Analytics workspace level.

Microsoft Purview Compliance Portal Permissions

The Purview compliance portal uses role groups that bundle Entra roles and workload-specific permissions together. You cannot assign a single Entra role and get all Purview capability; instead you assign the appropriate role group, and the role group carries the underlying permissions.

Most Purview role groups also require the user to hold a corresponding Entra role (often Compliance Administrator or Security Administrator) for full functionality — the role group alone is sometimes not sufficient for every workload action.

Exchange Online RBAC

Exchange Online uses RBAC role groups as its primary permission container. A role group contains one or more management roles, each of which contains cmdlets and scope. Notable role groups:

• Organization Management — full Exchange management (high privilege; the Exchange equivalent of Global Admin for the workload).
• Compliance Management — configure compliance features in Exchange (journal rules, retention, DLP transport rules).
• Discovery Management — perform mailbox searches and in-place eDiscovery.
• Records Management — manage retention tags, retention policies, and message classifications.
• View-Only Organization Management — read-only Exchange configuration; useful for auditors and monitoring tools.

Exchange role group membership can be modified in the Exchange admin center or with the Add-RoleGroupMember cmdlet.

Unified RBAC

Microsoft is converging Entra ID roles and Microsoft 365 workload roles into a unified RBAC model. From the Microsoft Defender portal and the Purview compliance portal you can now manage many role assignments in one place, and the Entra admin center's Role management experience increasingly surfaces workload role groups alongside Entra roles. The practical impact: an admin can grant a user security-operations access across Defender XDR, Purview, and Sentinel from a single role-group assignment rather than three separate steps in three portals.

The MS-102 exam expects you to recognize that role groups are the unit of delegation for Purview and Exchange, while Entra roles (built-in or custom) remain the unit for identity-level and Defender XDR top-level access.

Practical Delegation Examples

A SOC analyst who needs to triage incidents but not configure policies should be granted Security Reader (read-only across Defender XDR) or a custom Defender RBAC role limited to "active remediation actions." A compliance officer who needs to create retention policies but not eDiscovery holds should be granted the Records Management or Information Protection role group in Purview — not Compliance Administrator, which is broader. An auditor who needs to see Exchange configuration without changing it gets View-Only Organization Management in Exchange, not Organization Management.