Assign basic permissions for Microsoft Defender for Endpoint portal access

Basic permissions management gives existing Microsoft Defender for Endpoint customers two portal access levels: full access or read-only access. Use Microsoft Graph PowerShell to assign the Security Administrator role for full access or the Security Reader role for read-only access. For more granular permissions, use role-based access control.

Prerequisites

Complete these prerequisites before you assign user access:

• Confirm that your organization still uses basic permissions management. If your organization switched to RBAC, you can't switch back to basic permissions.
• Install Microsoft Graph PowerShell.
• Use an account assigned the Privileged Role Administrator role or a custom role with the required role-management permissions. Privileged Role Administrator is the least-privileged Microsoft Entra built-in role supported for this operation.
• Connect to Microsoft Graph by using Connect-MgGraph with the delegated RoleManagement.ReadWrite.Directory and User.ReadBasic.All permissions. For authentication options, see Microsoft Graph PowerShell authentication commands.

You don't need to run PowerShell as a local Windows administrator to assign Microsoft Entra roles through Microsoft Graph.

Understand the basic access levels

Basic permissions management provides these access levels:

• Full access: Users can sign in, view system information, resolve alerts, submit files for deep analysis, and download the onboarding package. Assign the Microsoft Entra Security Administrator role to grant full access.
• Read-only access: Users can sign in and view alerts and related information. They can't change alert states, submit files for deep analysis, or perform other state-changing operations. Assign the Microsoft Entra Security Reader role to grant read-only access.

Assign user access using Microsoft Graph PowerShell

Assign the appropriate Microsoft Entra role to each user who needs access to Defender for Endpoint.

Assign full access

Replace secadmin@contoso.onmicrosoft.com with the user principal name of the account that needs full access, and then run the following command:

New-MgDirectoryRoleMemberByRef -DirectoryRoleId (Get-MgDirectoryRole -Filter "DisplayName eq 'Security Administrator'").Id -OdataId "https://graph.microsoft.com/v1.0/directoryObjects/$((Get-MgUser -UserId 'secadmin@contoso.onmicrosoft.com').Id)"

Assign read-only access

Replace reader@contoso.onmicrosoft.com with the user principal name of the account that needs read-only access, and then run the following command:

New-MgDirectoryRoleMemberByRef -DirectoryRoleId (Get-MgDirectoryRole -Filter "DisplayName eq 'Security Reader'").Id -OdataId "https://graph.microsoft.com/v1.0/directoryObjects/$((Get-MgUser -UserId 'reader@contoso.onmicrosoft.com').Id)"

Related content

• Assign Microsoft Entra roles to users
• Manage Defender for Endpoint portal access permissions
• Manage portal access by using RBAC