# Plan separate Defender permissions when adopting cloud scopes

> Will existing Azure role assignments automatically provide access through Defender cloud scopes?

- Canonical URL: https://update.dsesecurity.com/updates/dse-20260917-155-plan-separate-defender-permissions-when-adopting-cloud-scopes/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-09-17T16:32:25+00:00
- Modified: 2026-09-17T16:46:28+00:00
- Last reviewed by DSE: 2026-09-17
- Resource type: Guide
- DSE priority: Information
- Topics: Cybersecurity, IT
- Reading time: 1 minutes

## What you need to know

Will existing Azure role assignments automatically provide access through Defender cloud scopes?

## Potentially affected

Use this review when evaluating cloud scopes and unified RBAC in the Microsoft Defender portal. Microsoft currently labels this capability preview; assess its documented limitations before planning production access.

## DSE recommendation

DSE recommends preparing an access matrix for the actual security tasks and resource populations each team needs.

## Article

## Source facts

Microsoft states that Defender unified RBAC is distinct from Azure RBAC and that permissions do not flow between the portals. For the new portal experience, users require their existing Azure permissions and an additional unified RBAC role. The cloud-scopes capability is currently in preview. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/defender-for-cloud/cloud-scopes-unified-rbac).

## Applicability

Use this review when evaluating cloud scopes and unified RBAC in the Microsoft Defender portal. Microsoft currently labels this capability preview; assess its documented limitations before planning production access.

## DSE recommendation

DSE recommends preparing an access matrix for the actual security tasks and resource populations each team needs. Map the Azure assignments and Defender role assignments separately, name their owners, and review the intended cloud scopes. Use the current preview limitations as explicit acceptance criteria so an existing Azure role is not mistaken for a completed Defender migration.

## Verification

With approved representative test accounts, verify the required views and actions in the relevant portal experience. Include a resource inside the intended scope and one outside it. Record the roles, scopes and observed access together. Resolve mismatches through the documented permissions model before widening a role or adding another administrator assignment.

## Official references

[Microsoft Learn: Manage cloud scopes and unified role-based access control (preview)](https://learn.microsoft.com/en-us/azure/defender-for-cloud/cloud-scopes-unified-rbac). Source reviewed September 17, 2026.

## Primary reference

- Name: Manage cloud scopes and unified role-based access control in Microsoft Defender for Cloud - Microsoft Defender for Cloud | Microsoft Learn
- Authority: Microsoft Learn
- URL: https://learn.microsoft.com/en-us/azure/defender-for-cloud/cloud-scopes-unified-rbac
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Plan separate Defender permissions when adopting cloud scopes,” DSE Security, https://update.dsesecurity.com/updates/dse-20260917-155-plan-separate-defender-permissions-when-adopting-cloud-scopes/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.