Plan separate Defender permissions when adopting cloud scopes

Source facts

Microsoft states that Defender unified RBAC is distinct from Azure RBAC and that permissions do not flow between the portals. For the new portal experience, users require their existing Azure permissions and an additional unified RBAC role. The cloud-scopes capability is currently in preview. Microsoft Learn.

Applicability

Use this review when evaluating cloud scopes and unified RBAC in the Microsoft Defender portal. Microsoft currently labels this capability preview; assess its documented limitations before planning production access.

DSE recommendation

DSE recommends preparing an access matrix for the actual security tasks and resource populations each team needs. Map the Azure assignments and Defender role assignments separately, name their owners, and review the intended cloud scopes. Use the current preview limitations as explicit acceptance criteria so an existing Azure role is not mistaken for a completed Defender migration.

Verification

With approved representative test accounts, verify the required views and actions in the relevant portal experience. Include a resource inside the intended scope and one outside it. Record the roles, scopes and observed access together. Resolve mismatches through the documented permissions model before widening a role or adding another administrator assignment.

Official references

Microsoft Learn: Manage cloud scopes and unified role-based access control (preview). Source reviewed September 17, 2026.