Restrict Security Admin Access.

Question

Hi,

I would like to restrict one of our Security Administrators’ access to all Microsoft admin portals except Microsoft Defender (security.microsoft.com). I attempted to use Conditional Access, but it blocked all admin access, including the Defender portal.

I am looking for a solution that allows access only to the Defender portal while preventing access to other Microsoft admin portals.

Answer 1

Have you considered granting the user Defender-specific role via the built-in RBAC controls, instead of the "global" role assignment? Check this article for more details: https://learn.microsoft.com/en-us/defender-xdr/manage-rbac

Answer 2

To restrict a Security Administrator's access to all Microsoft admin portals except for Microsoft Defender, you can utilize Conditional Access policies effectively. Here’s a general approach:

1. Create a Conditional Access Policy: Sign in to the Microsoft Entra admin center and navigate to Entra ID > Conditional Access > Policies.
2. Define the Policy:
   • Assignments: Under Users or workload identities, include the Security Administrator role.
   • Exclude: Under Users and groups, exclude the Security Administrator from the policy to allow access to the Defender portal.
3. Target Resources: Under Target resources, select Resources (formerly cloud apps) and include all Microsoft admin portals except for Microsoft Defender.
4. Access Controls: Set the access controls to block access to the selected portals while allowing access to Microsoft Defender.
5. Enable the Policy: After confirming your settings, enable the policy.

This setup should allow the Security Administrator to access Microsoft Defender while restricting access to other Microsoft admin portals. Ensure that the policy is tested in report-only mode before fully enabling it to avoid unintended lockouts.

---

References:

• Require multifactor authentication for admins accessing Microsoft admin portals
• Create a Conditional Access policy