Why can't I close alerts in Security Center?

Lee 6 Reputation points
2021-06-22T11:34:37.573+00:00

I have a security admin and reader account, yes when I try to close an alert I get a pop up message saying I can't due to missing permissions on the subscription or resource group.

Questions I have:

  1. How do I check for this?
  2. I have numerous subscriptions, do I need to check each one for this?

Thanks in advance.

Microsoft Defender for Cloud
Microsoft Defender for Cloud
An Azure service that provides threat protection for workloads running in Azure, on-premises, and in other clouds. Previously known as Azure Security Center and Azure Defender.
1,188 questions

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. JamesTran-MSFT 36,361 Reputation points Microsoft Employee
    2021-06-23T21:53:09.057+00:00

    @Lee
    Thank you for the quick response!

    I reached out to our ASC team, and was told that if you're using RBAC roles you should be able to quickly find which subscription is missing permissions. However, if you have any custom roles/groups this can be considerably time consuming to figure out which subscription needs the permissions. Lastly, if you'd like our ASC team to take a closer look into your environment, they'd be able to figure out which permissions you need.

    Additional Link:
    Permissions in Azure Security Center

    If you have any other questions or would like to be enabled for a free technical support request, please let me know.
    Thank you for your time and patience throughout this issue.

    ----------

    Please remember to "Accept Answer" if any answer/reply helped, so that others in the community facing similar issues can easily find the solution.