Connect CyberArk Identity only with the required API roles and permissions
The connection uses connector APIs to provide Defender for Identity visibility into and control over CyberArk identities. Microsoft requires the documented CyberArk role plus Microsoft Entra or Defender role-based access permissions before connection.
Read the checklist