Microsoft 365 Message Center item MC1457836

MC1457836 - Tenant will be auto-enabled into Microsoft Defender Unified RBAC

Microsoft Defender Unified RBAC will auto-enable on tenants starting late September 2026, completing by December 2026. It unifies access management across Defender and Sentinel workloads, importing existing roles with a 30-day notification period before activation. Opt-out is available post-activation; other Microsoft permissions remain unchanged.

Message Center ID

MC1457836

Category

plan For Change

Severity

normal

Services

Microsoft Defender XDR

Tags

Admin impact

Published

2026-08-19

Last updated

2026-08-19

Expires

2027-02-28

[What and why:]Microsoft Defender Unified RBAC (URBAC) is becoming the single access model for all Defender and Sentinel portal experiences. Your tenant will be auto enabled to URBAC.  Unified RBAC will be activated automatically for the in-scope workload(s) on your tenant following a notification period that begins when you receive the in-portal notification, and your roles are imported into Unified RBAC. Activation is expected to occur approximately 30 days after that notification date.  Unified RBAC offer more extended access management capabilities, including:  A single access management system to manage all roles and permissions across all workloads  Scoping capabilities such as Cloud, Sentinel, Identity, and Device Groups.     Future-proof assignments that will allow you to include future permissions and workloads This change applies exclusively to Microsoft Defender. Permissions for Microsoft Purview, Exchange Online, Microsoft Entra directory roles, Privileged Identity Management, and Azure resources (not related to Microsoft Sentinel) remain unchanged. In addition, if you are using Powershell with Microsoft Defender for Office 365, this will continue to work as is.  [Rollout Schedule:]Global: We will begin rolling out on late September 2026 and expect to complete by late December 2026.[Impact on your organization:]What you will see:Notification banner:  A notification will be displayed in the Microsoft Defender portal informing customers that the specified workload(s) will transition to Unified RBAC. Legacy RBAC roles are automatically imported into Unified RBAC. This date marks the beginning of the customer notification period before automatic activation Activation date: Beginning approximately 30 days after the notification date, Unified RBAC will be automatically enabled for the specified workload(s). Customers can review imported role assignments and prepare for the transition during this period. The in-portal banner in the Microsoft Defender portal (‘Permissions and roles’ page) will confirm activation. How this will affect your organization:  Your existing roles, if applicable, will be auto-imported into Unified RBAC. Because Unified RBAC is not yet active on your tenant for the workloads indicated, this import has no operational impact until activation. You may review and adjust the imported roles at any time from the Microsoft Defender portal. You may also re-run the import manually. Existing roles and permissions are mapped to Unified RBAC using a mapping logic. For more information on this mapping, please see here.  At the end of the notification period, Unified RBAC will be activated automatically for the in-scope workload(s). After activation, authorization for Defender/Sentinel portal experiences defaults to Unified RBAC roles; legacy RBAC assignments are no longer required to operate those portal experiences.  Opt-out: Self-service opt-out is available after activation. Go to the ‘workload settings’ control in Unified RBAC to instantly revert to your legacy RBAC system if needed.  If you are using APIs to configure your roles and permissions, please transfer to using the new Unified RBAC API  Delegated access (B2B/GDAP) or Multi-Tenant Management: remains unchanged. Roles that had assignments to B2B/GDAP users/groups will be included in the automatic import.    Entra directory roles are unchanged. Global Administrator, Security Administrator, Security Operator, and Security Reader continue to grant access to the Microsoft Defender portal as they do today. These roles will now map to Unified RBAC permissions as per the mapping referenced earlier. For more information on this mapping, please see here.  Azure RBAC continues to govern Azure resources, including Logic Apps and Workbooks.  Microsoft Sentinel specific workspace permissions (Sentinel Reader, Responder, Contributor roles) do get auto-enabled to Unified RBAC.   Email and Collaboration permissions and Exchange Online permissions continue to govern Exchange Online and Microsoft Purview scenarios. They are no longer required to operate Microsoft Defender for Office 365 portal experiences once Unified RBAC is active. [Action Required / Recommendations:] From the moment of the in-portal notification, review the auto-imported Unified RBAC role assignments in the Microsoft Defender portal (Permissions -> Roles). Validate that each user has the expected URBAC role and scope. Adjust assignments as needed. If any role assignments need to be updated, you can do so directly in the role assignment, even if Unified RBAC is not yet activated for that workload.   When using scoping: device groups continue to work as they do today. In addition, Unified RBAC allows you to use Cloud Scopes, Sentinel Scopes, and Identity Scopes.   Update internal documentation and runbooks to reflect the new Unified RBAC model. Microsoft Defender Unified RBAC overview: Microsoft Defender unified role-based access control (RBAC)  Review and manage imported Unified RBAC roles: Map existing RBAC permissions to Microsoft Defender unified RBAC permissions