MC1536045 - Microsoft Defender: Expanded URBAC permission support for email content access
Microsoft 365 Message Center announcement MC1536045.
MS Message Center's Summary
Microsoft Defender now extends unified role based access control permissions to include email content access for alerts concerning potentially malicious URL clicks. Security operations teams can preview and download relevant emails across four distinct alert scenarios. Administrators should review current permission assignments to confirm that security analysts possess the necessary rights for effective threat investigation.
- Administrator impact
- Administrators must review and update custom role permissions to grant access where required.
- End user impact
- No direct end user impact is expected.
- Importance
- 4/10: This update expands security analyst capabilities and requires role permission verification.
Permissions in Microsoft Defender unified role based access control
Microsoft Summary
Microsoft Defender has expanded Unified role-based access control (URBAC) permissions for email content access to include alerts related to potentially malicious URL clicks. Security analysts with the appropriate permission can now preview and download emails from four alert types, ensuring consistent access across scenarios.
- Message Center ID
- MC1536045
- Category
- stay Informed
- Severity
- normal
- Services
- Microsoft Defender XDR
- Tags
- Feature update, User impact, Admin impact
- Published
- 2026-11-03
- Last updated
- 2026-11-03
- Expires
- 2026-12-03
[What and why] We’re expanding Unified role-based access control (URBAC) permission support for Email & collaboration content: Emails associated with alerts in Microsoft Defender . This change provides more consistent email content access across alert investigation scenarios based on a user’s assigned permissions. Previously, this permission applied to: Email reported by user as malware or phish Email reported by user as junk With this rollout, the permission will also apply to: A potentially malicious URL click was detected A user clicked through to a potentially malicious URL [Rollout schedule] General Availability (Worldwide): Available now [Impact on your organization] Who is affected Security analysts who preview or download emails associated with the affected alerts Platforms and services Microsoft Defender What will happen Security analysts with the required permission will be able to preview and download emails associated with these four alerts: Email reported by user as malware or phish Email reported by user as junk A potentially malicious URL click was detected A user clicked through to a potentially malicious URL Access is based on the user’s assigned Email & collaboration content: Emails associated with alerts permission. [Action required and recommendations] Ensure that users who need to preview and download emails associated with these four alerts have the required Email & collaboration content: Emails associated with alerts permission. Learn more Permissions in Microsoft Defender unified role-based access control (RBAC) - Microsoft Defender XDR | Microsoft Learn [Compliance considerations] No compliance considerations identified. Review as usual for your organization.