Microsoft Entra built-in rolePublic reference
Security Operator
Creates and manages security events and performs identity containment actions during security incidents.
Explicit references to this role
These items name the role, a previously observed name, or its template GUID. A text reference does not establish impact, an assignment, or equivalent permissions. Connections use the current collected items.
- MC1486293 · Microsoft Defender for Office 365: Changes to Unified RBAC permission mapping for Microsoft Entra Security Operator roleReference-tenant notice · explicit role reference; verify applicability in your tenant
- MC1462464 · Microsoft Defender for Cloud Apps: App Governance support for the Cloud Application Administrator role is being retiredReference-tenant notice · explicit role reference; verify applicability in your tenant
- MC1457836 · Tenant will be auto-enabled into Microsoft Defender Unified RBACReference-tenant notice · explicit role reference; verify applicability in your tenant
Microsoft's role reference · Explore the separate Graph OAuth permission catalog. Resource actions do not establish an OAuth-scope mapping.