Public mode

No access to your tenant or devices. Every item links to its source. What this means

Some sources, documents or advisories need attention: 271/271 feeds/APIs · 464/464 docs · 8/9 advisories · checked 21:06 UTC Customize Public modeDiscuss ChangeIntel on Discord

Recorded 25 Oct 2026 at 17:12 UTC. This is what ChangeIntel recorded, including the title, summary, facts and links. It is not a statement of the source's current position. See the latest record.

Security Operator

Creates and manages security events and performs identity containment actions during security incidents.

Cite this recorded revision

What it said

Template ID
5f2222b1-57c3-48ba-8ad5-d4759f1fde6f
Privileged label
Marked privileged in Microsoft's reference
Permission coverage
Documented resource actions

Source evidence when recorded

entra-role-catalog
Complete at observationRead 25 Oct 2026 at 15:49 UTC

Coverage describes the sources at this observation. A complete read then does not establish their current position.

ChangeIntel

An IT change radar: releases, security, known issues, retirements, documentation changes, and service status from public sources. Every item links to supporting evidence; dates and statuses can change after they are read.

Sources read 25 Oct 21:06 UTC · 271 of 271 readable · 269 fully read · documentation 464/464 current