Take a look and decide whether this affects your tenant, users or support teams.
Primary Audience
Why this score?
AT A GLANCE
END USERS
IT ADMINS
ROLLOUT TIMELINE
Now
📢 Official Microsoft Message Center Announcement
Microsoft Defender: Expanded URBAC permission support for email content access
Message ID: MC1536045
[What and why]
We’re expanding Unified role-based access control (URBAC) permission support for Email & collaboration content: Emails associated with alerts in Microsoft Defender. This change provides more consistent email content access across alert investigation scenarios based on a user’s assigned permissions.
Previously, this permission applied to:
- Email reported by user as malware or phish
- Email reported by user as junk
With this rollout, the permission will also apply to:
- A potentially malicious URL click was detected
- A user clicked through to a potentially malicious URL
[Rollout schedule]
General Availability (Worldwide): Available now
[Impact on your organization]
Who is affected
- Security analysts who preview or download emails associated with the affected alerts
Platforms and services
- Microsoft Defender
What will happen
Security analysts with the required permission will be able to preview and download emails associated with these four alerts:
- Email reported by user as malware or phish
- Email reported by user as junk
- A potentially malicious URL click was detected
- A user clicked through to a potentially malicious URL
Access is based on the user’s assigned Email & collaboration content: Emails associated with alerts permission.
[Action required and recommendations]
Ensure that users who need to preview and download emails associated with these four alerts have the required Email & collaboration content: Emails associated with alerts permission.
Learn more
[Compliance considerations]
No compliance considerations identified. Review as usual for your organization.
Source: Microsoft Message Center • Analysed by MWPro
