Microsoft Entra built-in rolePublic reference
Security Operator
Creates and manages security events and performs identity containment actions during security incidents.
Compare this role or its retained definitions
Explicit references to this role
These items name the role, a previously observed name, or its template GUID. A text reference does not establish impact, an assignment, or equivalent permissions. Connections use the current collected items.
- MC1486293 · Microsoft Defender for Office 365: Changes to Unified RBAC permission mapping for Microsoft Entra Security Operator roleReference-tenant notice · explicit role reference; verify applicability in your tenant
- MC1462464 · Microsoft Defender for Cloud Apps: App Governance support for the Cloud Application Administrator role is being retiredReference-tenant notice · explicit role reference; verify applicability in your tenant
- MC1457836 · Tenant will be auto-enabled into Microsoft Defender Unified RBACReference-tenant notice · explicit role reference; verify applicability in your tenant
Microsoft's role reference · Explore the separate Graph OAuth permission catalog. Resource actions do not establish an OAuth-scope mapping.