What permission do I need to access Microsoft Defender - Incidents?

GeneR 0 Reputation points
2024-03-12T13:12:45.6966667+00:00

I'm currently accessing a incident on our environment but I can't access it. It gives my this error message.

User's image

"You can’t access this section.

Sorry, you can’t access this section. Check with your administrator for the role-based access permissions to see the data."

I'm already a Security admin but still can't access.

Microsoft 365
Microsoft 365
Formerly Office 365, is a line of subscription services offered by Microsoft which adds to and includes the Microsoft Office product line.
4,217 questions
Microsoft Defender for Cloud
Microsoft Defender for Cloud
An Azure service that provides threat protection for workloads running in Azure, on-premises, and in other clouds. Previously known as Azure Security Center and Azure Defender.
1,250 questions
Microsoft Defender for Identity
Microsoft Defender for Identity
A Microsoft service that helps protect enterprise hybrid environments from multiple types of advanced, targeted cyberattacks and insider threats.
175 questions
0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. James Hamil 22,976 Reputation points Microsoft Employee
    2024-03-12T21:18:43.36+00:00

    Hi @GeneR , as a Security Admin you should have access to this. However, there are a few things you can check to ensure that you have the necessary permissions to access the incidents:

    1. Make sure that you are assigned the Security Admin role in the Azure portal. You can check this by going to Azure Active Directory > Roles and administrators > Security Admins. If you are not assigned this role, you will need to have an administrator assign it to you.
    2. Check if there are any custom roles or policies that are blocking your access to the incidents. You can check this by going to Azure Active Directory > Roles and administrators > Conditional Access. If there are any policies that are blocking your access, you will need to have an administrator modify them to allow your access.
    3. Ensure that you have the necessary permissions to access the specific incident you are trying to view. You can check this by going to Microsoft Defender Security Center > Incidents > Select the incident > Permissions. If you do not have the necessary permissions, you will need to have an administrator modify them to allow your access.

    If this still doesn't work please let me know and I can help you further.

    Please let me know if you have any questions and I can help you further.

    If this answer helps you please mark "Accept Answer" so other users can reference it.

    Thank you,

    James

    0 comments