Microsoft Defender: Expanded URBAC permission support for email content access

What and why We’re expanding Unified role-based access control (URBAC) permission support for Email & collaboration content: Emails associated with alerts in Microsoft Defender. This change provides more consistent email content access across alert investigation scenarios based on a user’s assigned permissions. Previously, this permission applied to: Email reported by user as malware or phish Email reported by user as junk With this rollout, the permission will also apply to: A potentially malicious URL click was detected A user clicked through to a potentially malicious URL Rollout schedule General Availability (Worldwide): Available now Impact on your organization Who is affected Security analysts who preview or download emails associated with the affected alerts Platforms and services Microsoft Defender What will happen Security analysts with the required permission will be able to preview and download emails associated with these four alerts: Email reported by user as malware or phish Email reported by user as junk A potentially malicious URL click was detected A user clicked through to a potentially malicious URL Access is based on the user’s assigned Email & collaboration content: Emails associated with alerts permission. Action required and recommendations Ensure that users who need to preview and download emails associated with these four alerts have the required Email & collaboration content: Emails associated with alerts permission. Learn more Permissions in Microsoft Defender unified role-based access control (RBAC) - Microsoft Defender XDR | Microsoft Learn Compliance considerations No compliance considerations identified. Review as usual for your organization.