How to use PIM with role permissions in Microsoft 365 Defender?

Kiril 96

We are using PIM for admin role management. However, some of the functionality in Microsoft 365 Defender requires additional roles, which are not part of being e.g. a Security Administrator. In order to do a "Hard Delete" action on phishing e-mails, you need an additional Search and Purge role assigned in the Microsoft 365 Defender as stated here: https://learn.microsoft.com/en-us/microsoft-365/security/defender/m365d-action-center?view=o365-worldwide#required-permissions-for-action-center-tasks.

How can I assign the additional Surge and Purge role using PIM?

Shweta Mathur 30,296 Reputation points Microsoft Employee Moderator

2023-03-06T13:12:56.0433333+00:00

Hi @Kiril ,

Just checking in to see if the below answer helped. If this answers your query, please don’t forget to click "Accept Answer" which might be beneficial to other community members reading this thread. And, if you have any further query do let us know.

Thanks, Shweta

Accepted answer

Andy David - MVP 157.8K Reputation points MVP Volunteer Moderator

2023-03-02T17:52:16.6133333+00:00

Hi there, You can use this doc and add the role to custom PIM enabled security group:

https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/use-privileged-identity-management-in-defender-for-office-365?view=o365-worldwide
Please sign in to rate this answer.
Kiril 96 Reputation points

2023-03-03T12:30:28.1133333+00:00

Thank you for the link, looks exactly like the use case I needed. One question though about the steps described here:

https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/use-privileged-identity-management-in-defender-for-office-365?view=o365-worldwide#create-a-role-group-requiring-the-permissions-we-need

There are two different roles sections which can be used for the same thing. I can create a Surge and Purge role in Microsoft 365 Defender and Email & collaboration roles. Is there any difference?

Kiril 96 Reputation points

2023-03-03T12:51:50.4733333+00:00

One question about the Permissions in https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/use-privileged-identity-management-in-defender-for-office-365?view=o365-worldwide#create-a-role-group-requiring-the-permissions-we-need.

What is the difference between Roles in Microsoft 365 Defender and Roles in Email & collaboration?

Andy David - MVP 157.8K Reputation points MVP Volunteer Moderator

2023-03-03T12:57:14.8166667+00:00

yes its the same role. I assigned under the "Email" role section and it works as expected:

https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/remediate-malicious-email-delivered-office-365?view=o365-worldwide#what-you-need-to-know-before-you-begin
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

0 additional answers

Your answer