Defender Action Center Approve/Reject greyed out

Question

Defender Action Center Approve/Reject greyed out

DrDefender 35

Up until last week we were able to check out the Security Administrator role in order to take action on a reported email in the defender action center. Now it is greyed out after we check out the role and we are unable to approve or reject actions. For example there is an action to soft delete the emails. Normally i'd go in and approve them with the Security administrator role, but now it is greyed out. We have cleared sessions and restarted browsers etc. We can confirm we have the role, just the permissions are not working the same.

User's image

Piotr Ścibior 0 Reputation points

2024-08-20T07:54:49.5333333+00:00

I have the same problem. This MS article states that an Entra ID Security Admin role should be enough: https://learn.microsoft.com/en-us/defender-xdr/m365d-action-center. But for a week or two that is not the case. Does this mean that I need to assign my group a role for "Search and Purge" in Defender? I am using PIM to activate admin roles and this would complicate things.

2 answers

Your answer

Piotr Ścibior 0 Reputation points

2024-08-20T07:54:49.5333333+00:00

I have the same problem. This MS article states that an Entra ID Security Admin role should be enough: https://learn.microsoft.com/en-us/defender-xdr/m365d-action-center. But for a week or two that is not the case. Does this mean that I need to assign my group a role for "Search and Purge" in Defender? I am using PIM to activate admin roles and this would complicate things.

Answer 1

DrDefender 35

We got it working by configuring a new role in XDR RBAC
https://learn.microsoft.com/en-us/defender-xdr/create-custom-rbac-roles

then activating the unified RBAC
https://learn.microsoft.com/en-us/defender-xdr/activate-defender-rbac

Gina Qu 0 Reputation points

2024-08-28T20:11:15.2433333+00:00

we got the same issue, and what permissions you grant for the new role?
DrDefender 35 Reputation points

2024-08-29T15:14:08.8633333+00:00

"all read and manage permissions" if i recall
Piotr Ścibior 0 Reputation points

2024-09-04T08:48:56.14+00:00

So I have also configured an Entra ID group with "active" permissions of a Entra ID Security admin and Defender role of Security Management. Users can enable access to this group using Privileged Identity Management. This works but we need to wait 5-10 minutes after enabling access to the group for the Defender role to be activated.
good morning 0 Reputation points

2024-09-10T11:54:43.0933333+00:00

Hi Piotr, may I know how can you perform this on Entra ID?
Piotr Ścibior 0 Reputation points

2024-09-10T12:11:28.9266667+00:00
Assuming that you have the necessary licensing and have experience with Privileged Identity Management on Azure:

Create an Entra ID group for users and turn on PIM for that group.

Assign "active" role for that group of Exchange admin in Entra ID and assign an "active" role in Microsoft Defender Portal/System/Permissions/Email&Colaboration role of Organization Management.

Use PIM to assign "eligible" access to that group for users.

Users then can have necessary roles using PIM.
Kamel Powers 0 Reputation points

2024-09-16T15:54:12.6166667+00:00

Piotr - thank you for this information. I'm trying to understand your comment so we can build out a similar workflow to ensure our admins activate their role using PIM without having permissions active 24/7. Could you please clarify point 2 and 3 as I'm not understanding the active role to exchange comment and how PIM will enable the additional permissions in Defender?

Answer 2

I'm not happy with how Microsoft handled this specific rights assignment and how the explanation found in the link below is written, but this is how we fixed it:

Explanation: https://learn.microsoft.com/en-us/defender-xdr/m365d-action-center

In the Entra ID portal:

Create a Security group and allow rights to be assigned to it.
Add the members you want to assign the rights to.
Assign the role 'Security Administrator' to that group.

In the Security Cental portal:

Go to 'Settings' and select 'Email & collaboration'
- Assign the role 'Security Administrator' to the group you created
- Assign the role 'Data Investigator' to the group you created
Go to 'Settings' and select 'Endpoints'
- Assign the role 'Microsoft Defender for Endpoint administrator (default)' to the group you created

Remarq: According to this information: https://learn.microsoft.com/en-us/defender-office-365/mdo-portal-permissions
If you activate Defender XDR RBAC for Email & collaboration, the permissions page at https://security.microsoft.com/emailandcollabpermissions is no longer available in the Defender portal, so you need to ensure that you configure or import your roles before you activate Defender XDR Unified RBAC.

(or just disable RBAC by turning of the workflows (slider button to 'off')

Share via

Defender Action Center Approve/Reject greyed out

2 answers

Your answer