{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-437-check-inherited-full-access-before-narrowing-a-cloud-apps-administrator-locally/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260909-437-check-inherited-full-access-before-narrowing-a-cloud-apps-administrator-locally/", "slug": "dse-20260909-437-check-inherited-full-access-before-narrowing-a-cloud-apps-administrator-locally", "url": "https://update.dsesecurity.com/updates/dse-20260909-437-check-inherited-full-access-before-narrowing-a-cloud-apps-administrator-locally/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260909-437-check-inherited-full-access-before-narrowing-a-cloud-apps-administrator-locally.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-437-check-inherited-full-access-before-narrowing-a-cloud-apps-administrator-locally/" }, "title": "Check inherited full access before narrowing a Cloud Apps administrator locally", "summary": "Can a local Defender for Cloud Apps role override an Entra role that already grants full access?", "format": { "slug": "briefing", "name": "Briefing" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "cyber-defense", "label": "Cyber defense", "alt": "Layered glass and metal cyber-defense structure with controlled blue and gold signal paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "it", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-10T00:24:39+00:00", "modified_at": "2026-09-10T02:04:57+00:00", "reviewed_on": "2026-09-09", "reading_minutes": 2, "word_count": 257, "potentially_affected": "Administrators reviewing Microsoft Entra, Microsoft 365 and local Defender for Cloud Apps role assignments.", "dse_recommendation": "Inspect the directory role assignments before relying on a narrower local Cloud Apps role as the access boundary.", "primary_source": { "name": "Configure admin access - Microsoft Defender for Cloud Apps | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/defender-cloud-apps/manage-admins", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

Defender for Cloud Apps can override some Microsoft Entra or Microsoft 365 permissions through a manually added local administrator role. It cannot override Entra roles already providing full access: Global administrator, Security administrator and Cloud App Security administrator. Those directory-service roles do not appear on the Cloud Apps Manage admin access page. The built-in local Cloud Apps roles grant access only to that service. Microsoft Learn.

\n

Applicability

\n

Use this distinction when an administrator is meant to have limited Cloud Apps responsibilities but may also hold a broader directory role. A local assignment review is only part of the access review; it does not establish the complete inherited permission set.

\n

DSE recommendation

\n

Inspect the directory role assignments before relying on a narrower local Cloud Apps role as the access boundary. Have the identity owner and Cloud Apps owner reconcile the user’s intended duties with both assignment surfaces. If a broader role is required for another task, document that conflict and consider a separate administrative identity under the organization’s access policy. Do not describe the local role as a restriction that the product cannot enforce.

\n

Verification

\n

With an approved test identity, compare the expected visible data and allowed actions with actual access. Include a directory-role review rather than checking only the Cloud Apps role list. Preserve the assignment evidence and observed restrictions without performing destructive governance actions. Resolve unexpected full access before signing off the narrower role, and repeat the comparison after any approved directory-role change.

\n

Official references

\n

Microsoft Learn: Configure Cloud Apps admin access. Source reviewed September 9, 2026.

", "content_text": "Source facts\nDefender for Cloud Apps can override some Microsoft Entra or Microsoft 365 permissions through a manually added local administrator role. It cannot override Entra roles already providing full access: Global administrator, Security administrator and Cloud App Security administrator. Those directory-service roles do not appear on the Cloud Apps Manage admin access page. The built-in local Cloud Apps roles grant access only to that service. Microsoft Learn.\nApplicability\nUse this distinction when an administrator is meant to have limited Cloud Apps responsibilities but may also hold a broader directory role. A local assignment review is only part of the access review; it does not establish the complete inherited permission set.\nDSE recommendation\nInspect the directory role assignments before relying on a narrower local Cloud Apps role as the access boundary. Have the identity owner and Cloud Apps owner reconcile the user’s intended duties with both assignment surfaces. If a broader role is required for another task, document that conflict and consider a separate administrative identity under the organization’s access policy. Do not describe the local role as a restriction that the product cannot enforce.\nVerification\nWith an approved test identity, compare the expected visible data and allowed actions with actual access. Include a directory-role review rather than checking only the Cloud Apps role list. Preserve the assignment evidence and observed restrictions without performing destructive governance actions. Resolve unexpected full access before signing off the narrower role, and repeat the comparison after any approved directory-role change.\nOfficial references\nMicrosoft Learn: Configure Cloud Apps admin access. Source reviewed September 9, 2026.", "content_markdown": "## Source facts\n\nDefender for Cloud Apps can override some Microsoft Entra or Microsoft 365 permissions through a manually added local administrator role. It cannot override Entra roles already providing full access: Global administrator, Security administrator and Cloud App Security administrator. Those directory-service roles do not appear on the Cloud Apps Manage admin access page. The built-in local Cloud Apps roles grant access only to that service. [Microsoft Learn](https://learn.microsoft.com/en-us/defender-cloud-apps/manage-admins).\n\n## Applicability\n\nUse this distinction when an administrator is meant to have limited Cloud Apps responsibilities but may also hold a broader directory role. A local assignment review is only part of the access review; it does not establish the complete inherited permission set.\n\n## DSE recommendation\n\nInspect the directory role assignments before relying on a narrower local Cloud Apps role as the access boundary. Have the identity owner and Cloud Apps owner reconcile the user’s intended duties with both assignment surfaces. If a broader role is required for another task, document that conflict and consider a separate administrative identity under the organization’s access policy. Do not describe the local role as a restriction that the product cannot enforce.\n\n## Verification\n\nWith an approved test identity, compare the expected visible data and allowed actions with actual access. Include a directory-role review rather than checking only the Cloud Apps role list. Preserve the assignment evidence and observed restrictions without performing destructive governance actions. Resolve unexpected full access before signing off the narrower role, and repeat the comparison after any approved directory-role change.\n\n## Official references\n\n[Microsoft Learn: Configure Cloud Apps admin access](https://learn.microsoft.com/en-us/defender-cloud-apps/manage-admins). Source reviewed September 9, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260909-437-check-inherited-full-access-before-narrowing-a-cloud-apps-administrator-locally/", "url": "https://update.dsesecurity.com/updates/dse-20260909-437-check-inherited-full-access-before-narrowing-a-cloud-apps-administrator-locally/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-09" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260909-437-check-inherited-full-access-before-narrowing-a-cloud-apps-administrator-locally/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Check inherited full access before narrowing a Cloud Apps administrator locally", "item": "https://update.dsesecurity.com/updates/dse-20260909-437-check-inherited-full-access-before-narrowing-a-cloud-apps-administrator-locally/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260909-437-check-inherited-full-access-before-narrowing-a-cloud-apps-administrator-locally/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260909-437-check-inherited-full-access-before-narrowing-a-cloud-apps-administrator-locally/", "url": "https://update.dsesecurity.com/updates/dse-20260909-437-check-inherited-full-access-before-narrowing-a-cloud-apps-administrator-locally/", "headline": "Check inherited full access before narrowing a Cloud Apps administrator locally", "description": "Can a local Defender for Cloud Apps role override an Entra role that already grants full access?", "abstract": "Can a local Defender for Cloud Apps role override an Entra role that already grants full access?", "articleBody": "Source facts\nDefender for Cloud Apps can override some Microsoft Entra or Microsoft 365 permissions through a manually added local administrator role. It cannot override Entra roles already providing full access: Global administrator, Security administrator and Cloud App Security administrator. Those directory-service roles do not appear on the Cloud Apps Manage admin access page. The built-in local Cloud Apps roles grant access only to that service. Microsoft Learn.\nApplicability\nUse this distinction when an administrator is meant to have limited Cloud Apps responsibilities but may also hold a broader directory role. A local assignment review is only part of the access review; it does not establish the complete inherited permission set.\nDSE recommendation\nInspect the directory role assignments before relying on a narrower local Cloud Apps role as the access boundary. Have the identity owner and Cloud Apps owner reconcile the user’s intended duties with both assignment surfaces. If a broader role is required for another task, document that conflict and consider a separate administrative identity under the organization’s access policy. Do not describe the local role as a restriction that the product cannot enforce.\nVerification\nWith an approved test identity, compare the expected visible data and allowed actions with actual access. Include a directory-role review rather than checking only the Cloud Apps role list. Preserve the assignment evidence and observed restrictions without performing destructive governance actions. Resolve unexpected full access before signing off the narrower role, and repeat the comparison after any approved directory-role change.\nOfficial references\nMicrosoft Learn: Configure Cloud Apps admin access. Source reviewed September 9, 2026.", "datePublished": "2026-09-10T00:24:39+00:00", "dateModified": "2026-09-10T02:04:57+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260909-437-check-inherited-full-access-before-narrowing-a-cloud-apps-administrator-locally/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260909-437-check-inherited-full-access-before-narrowing-a-cloud-apps-administrator-locally/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Check inherited full access before narrowing a Cloud Apps administrator locally" }, "articleSection": [ "Cybersecurity", "IT" ], "keywords": [ "Cybersecurity", "IT", "Briefing", "Information priority" ], "genre": "Briefing", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "wordCount": 257, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Configure admin access - Microsoft Defender for Cloud Apps | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/defender-cloud-apps/manage-admins" } } ] } }