{
    "api_version": "1",
    "kind": "dse_post",
    "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260917-155-plan-separate-defender-permissions-when-adopting-cloud-scopes/",
    "item": {
        "id": "https://update.dsesecurity.com/updates/dse-20260917-155-plan-separate-defender-permissions-when-adopting-cloud-scopes/",
        "slug": "dse-20260917-155-plan-separate-defender-permissions-when-adopting-cloud-scopes",
        "url": "https://update.dsesecurity.com/updates/dse-20260917-155-plan-separate-defender-permissions-when-adopting-cloud-scopes/",
        "alternate_urls": {
            "markdown": "https://update.dsesecurity.com/updates/dse-20260917-155-plan-separate-defender-permissions-when-adopting-cloud-scopes.md",
            "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260917-155-plan-separate-defender-permissions-when-adopting-cloud-scopes/"
        },
        "title": "Plan separate Defender permissions when adopting cloud scopes",
        "summary": "Will existing Azure role assignments automatically provide access through Defender cloud scopes?",
        "format": {
            "slug": "guide",
            "name": "Guide"
        },
        "priority": {
            "slug": "info",
            "name": "Information"
        },
        "featured": false,
        "image": {
            "theme": "cyber-defense",
            "label": "Cyber defense",
            "alt": "Layered glass and metal cyber-defense structure with controlled blue and gold signal paths.",
            "card_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-card.webp?v=1.8.20",
            "hero_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-hero.webp?v=1.8.20",
            "social_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20",
            "width": 2400,
            "height": 1350
        },
        "topics": [
            {
                "slug": "cybersecurity",
                "name": "Cybersecurity",
                "url": "https://update.dsesecurity.com/topic/cybersecurity/"
            },
            {
                "slug": "it",
                "name": "IT",
                "url": "https://update.dsesecurity.com/topic/it/"
            }
        ],
        "author": {
            "name": "DSE Security Editorial Team",
            "url": "https://update.dsesecurity.com/#editorial-team",
            "type": "Organization"
        },
        "publisher": {
            "name": "Detection Systems & Engineering",
            "url": "https://dsesecurity.com/"
        },
        "published_at": "2026-09-17T16:32:25+00:00",
        "modified_at": "2026-09-17T16:46:28+00:00",
        "reviewed_on": "2026-09-17",
        "reading_minutes": 1,
        "word_count": 205,
        "potentially_affected": "Use this review when evaluating cloud scopes and unified RBAC in the Microsoft Defender portal. Microsoft currently labels this capability preview; assess its documented limitations before planning production access.",
        "dse_recommendation": "DSE recommends preparing an access matrix for the actual security tasks and resource populations each team needs.",
        "primary_source": {
            "name": "Manage cloud scopes and unified role-based access control in Microsoft Defender for Cloud - Microsoft Defender for Cloud | Microsoft Learn",
            "url": "https://learn.microsoft.com/en-us/azure/defender-for-cloud/cloud-scopes-unified-rbac",
            "published_on": null,
            "authority": "Microsoft Learn"
        },
        "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/",
        "usage_info": "https://update.dsesecurity.com/usage/",
        "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.",
        "content_html": "<h2>Source facts</h2>\n<p>Microsoft states that Defender unified RBAC is distinct from Azure RBAC and that permissions do not flow between the portals. For the new portal experience, users require their existing Azure permissions and an additional unified RBAC role. The cloud-scopes capability is currently in preview. <a href=\"https://learn.microsoft.com/en-us/azure/defender-for-cloud/cloud-scopes-unified-rbac\" target=\"_blank\" rel=\"noopener noreferrer\">Microsoft Learn</a>.</p>\n<h2>Applicability</h2>\n<p>Use this review when evaluating cloud scopes and unified RBAC in the Microsoft Defender portal. Microsoft currently labels this capability preview; assess its documented limitations before planning production access.</p>\n<h2>DSE recommendation</h2>\n<p>DSE recommends preparing an access matrix for the actual security tasks and resource populations each team needs. Map the Azure assignments and Defender role assignments separately, name their owners, and review the intended cloud scopes. Use the current preview limitations as explicit acceptance criteria so an existing Azure role is not mistaken for a completed Defender migration.</p>\n<h2>Verification</h2>\n<p>With approved representative test accounts, verify the required views and actions in the relevant portal experience. Include a resource inside the intended scope and one outside it. Record the roles, scopes and observed access together. Resolve mismatches through the documented permissions model before widening a role or adding another administrator assignment.</p>\n<h2>Official references</h2>\n<p><a href=\"https://learn.microsoft.com/en-us/azure/defender-for-cloud/cloud-scopes-unified-rbac\" target=\"_blank\" rel=\"noopener noreferrer\">Microsoft Learn: Manage cloud scopes and unified role-based access control (preview)</a>. Source reviewed September 17, 2026.</p>",
        "content_text": "Source facts\nMicrosoft states that Defender unified RBAC is distinct from Azure RBAC and that permissions do not flow between the portals. For the new portal experience, users require their existing Azure permissions and an additional unified RBAC role. The cloud-scopes capability is currently in preview. Microsoft Learn.\nApplicability\nUse this review when evaluating cloud scopes and unified RBAC in the Microsoft Defender portal. Microsoft currently labels this capability preview; assess its documented limitations before planning production access.\nDSE recommendation\nDSE recommends preparing an access matrix for the actual security tasks and resource populations each team needs. Map the Azure assignments and Defender role assignments separately, name their owners, and review the intended cloud scopes. Use the current preview limitations as explicit acceptance criteria so an existing Azure role is not mistaken for a completed Defender migration.\nVerification\nWith approved representative test accounts, verify the required views and actions in the relevant portal experience. Include a resource inside the intended scope and one outside it. Record the roles, scopes and observed access together. Resolve mismatches through the documented permissions model before widening a role or adding another administrator assignment.\nOfficial references\nMicrosoft Learn: Manage cloud scopes and unified role-based access control (preview). Source reviewed September 17, 2026.",
        "content_markdown": "## Source facts\n\nMicrosoft states that Defender unified RBAC is distinct from Azure RBAC and that permissions do not flow between the portals. For the new portal experience, users require their existing Azure permissions and an additional unified RBAC role. The cloud-scopes capability is currently in preview. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/defender-for-cloud/cloud-scopes-unified-rbac).\n\n## Applicability\n\nUse this review when evaluating cloud scopes and unified RBAC in the Microsoft Defender portal. Microsoft currently labels this capability preview; assess its documented limitations before planning production access.\n\n## DSE recommendation\n\nDSE recommends preparing an access matrix for the actual security tasks and resource populations each team needs. Map the Azure assignments and Defender role assignments separately, name their owners, and review the intended cloud scopes. Use the current preview limitations as explicit acceptance criteria so an existing Azure role is not mistaken for a completed Defender migration.\n\n## Verification\n\nWith approved representative test accounts, verify the required views and actions in the relevant portal experience. Include a resource inside the intended scope and one outside it. Record the roles, scopes and observed access together. Resolve mismatches through the documented permissions model before widening a role or adding another administrator assignment.\n\n## Official references\n\n[Microsoft Learn: Manage cloud scopes and unified role-based access control (preview)](https://learn.microsoft.com/en-us/azure/defender-for-cloud/cloud-scopes-unified-rbac). Source reviewed September 17, 2026."
    },
    "json_ld": {
        "@context": "https://schema.org",
        "@graph": [
            {
                "@type": "Organization",
                "@id": "https://dsesecurity.com/#organization",
                "name": "Detection Systems & Engineering",
                "alternateName": "DSE Security",
                "url": "https://dsesecurity.com/",
                "logo": {
                    "@type": "ImageObject",
                    "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20"
                }
            },
            {
                "@type": "Organization",
                "@id": "https://update.dsesecurity.com/#editorial-team",
                "name": "DSE Security Editorial Team",
                "url": "https://update.dsesecurity.com/",
                "parentOrganization": {
                    "@id": "https://dsesecurity.com/#organization"
                }
            },
            {
                "@type": "WebSite",
                "@id": "https://update.dsesecurity.com/#website",
                "name": "DSE Updates",
                "alternateName": "DSE Security Knowledge Hub",
                "url": "https://update.dsesecurity.com/",
                "inLanguage": "en-US",
                "publisher": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "potentialAction": {
                    "@type": "SearchAction",
                    "target": {
                        "@type": "EntryPoint",
                        "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}"
                    },
                    "query-input": "required name=search_term_string"
                }
            },
            {
                "@type": "WebPage",
                "@id": "https://update.dsesecurity.com/updates/dse-20260917-155-plan-separate-defender-permissions-when-adopting-cloud-scopes/",
                "url": "https://update.dsesecurity.com/updates/dse-20260917-155-plan-separate-defender-permissions-when-adopting-cloud-scopes/",
                "isPartOf": {
                    "@id": "https://update.dsesecurity.com/#website"
                },
                "lastReviewed": "2026-09-17"
            },
            {
                "@type": "BreadcrumbList",
                "@id": "https://update.dsesecurity.com/updates/dse-20260917-155-plan-separate-defender-permissions-when-adopting-cloud-scopes/#breadcrumbs",
                "itemListElement": [
                    {
                        "@type": "ListItem",
                        "position": 1,
                        "name": "DSE Updates",
                        "item": "https://update.dsesecurity.com/"
                    },
                    {
                        "@type": "ListItem",
                        "position": 2,
                        "name": "Plan separate Defender permissions when adopting cloud scopes",
                        "item": "https://update.dsesecurity.com/updates/dse-20260917-155-plan-separate-defender-permissions-when-adopting-cloud-scopes/"
                    }
                ]
            },
            {
                "@type": [
                    "Article",
                    "TechArticle"
                ],
                "@id": "https://update.dsesecurity.com/updates/dse-20260917-155-plan-separate-defender-permissions-when-adopting-cloud-scopes/#article",
                "identifier": "https://update.dsesecurity.com/updates/dse-20260917-155-plan-separate-defender-permissions-when-adopting-cloud-scopes/",
                "url": "https://update.dsesecurity.com/updates/dse-20260917-155-plan-separate-defender-permissions-when-adopting-cloud-scopes/",
                "headline": "Plan separate Defender permissions when adopting cloud scopes",
                "description": "Will existing Azure role assignments automatically provide access through Defender cloud scopes?",
                "abstract": "Will existing Azure role assignments automatically provide access through Defender cloud scopes?",
                "articleBody": "Source facts\nMicrosoft states that Defender unified RBAC is distinct from Azure RBAC and that permissions do not flow between the portals. For the new portal experience, users require their existing Azure permissions and an additional unified RBAC role. The cloud-scopes capability is currently in preview. Microsoft Learn.\nApplicability\nUse this review when evaluating cloud scopes and unified RBAC in the Microsoft Defender portal. Microsoft currently labels this capability preview; assess its documented limitations before planning production access.\nDSE recommendation\nDSE recommends preparing an access matrix for the actual security tasks and resource populations each team needs. Map the Azure assignments and Defender role assignments separately, name their owners, and review the intended cloud scopes. Use the current preview limitations as explicit acceptance criteria so an existing Azure role is not mistaken for a completed Defender migration.\nVerification\nWith approved representative test accounts, verify the required views and actions in the relevant portal experience. Include a resource inside the intended scope and one outside it. Record the roles, scopes and observed access together. Resolve mismatches through the documented permissions model before widening a role or adding another administrator assignment.\nOfficial references\nMicrosoft Learn: Manage cloud scopes and unified role-based access control (preview). Source reviewed September 17, 2026.",
                "datePublished": "2026-09-17T16:32:25+00:00",
                "dateModified": "2026-09-17T16:46:28+00:00",
                "mainEntityOfPage": {
                    "@id": "https://update.dsesecurity.com/updates/dse-20260917-155-plan-separate-defender-permissions-when-adopting-cloud-scopes/"
                },
                "inLanguage": "en-US",
                "isAccessibleForFree": true,
                "author": {
                    "@type": "Organization",
                    "name": "DSE Security Editorial Team",
                    "url": "https://update.dsesecurity.com/#editorial-team"
                },
                "publisher": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "image": {
                    "@type": "ImageObject",
                    "@id": "https://update.dsesecurity.com/updates/dse-20260917-155-plan-separate-defender-permissions-when-adopting-cloud-scopes/#primaryimage",
                    "url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20",
                    "contentUrl": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20",
                    "width": 1200,
                    "height": 630,
                    "caption": "Plan separate Defender permissions when adopting cloud scopes"
                },
                "articleSection": [
                    "Cybersecurity",
                    "IT"
                ],
                "keywords": [
                    "Cybersecurity",
                    "IT",
                    "Guide",
                    "Information priority"
                ],
                "genre": "Guide",
                "about": [
                    {
                        "@type": "Thing",
                        "name": "Cybersecurity",
                        "url": "https://update.dsesecurity.com/topic/cybersecurity/"
                    },
                    {
                        "@type": "Thing",
                        "name": "IT",
                        "url": "https://update.dsesecurity.com/topic/it/"
                    }
                ],
                "wordCount": 205,
                "timeRequired": "PT1M",
                "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/",
                "usageInfo": "https://update.dsesecurity.com/usage/",
                "copyrightHolder": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.",
                "citation": {
                    "@type": "CreativeWork",
                    "name": "Manage cloud scopes and unified role-based access control in Microsoft Defender for Cloud - Microsoft Defender for Cloud | Microsoft Learn",
                    "url": "https://learn.microsoft.com/en-us/azure/defender-for-cloud/cloud-scopes-unified-rbac"
                }
            }
        ]
    }
}