Enhance role assignment details for Microsoft Sentinel onboarding#531
Open
Khadinxc wants to merge 1 commit into
Open
Enhance role assignment details for Microsoft Sentinel onboarding#531Khadinxc wants to merge 1 commit into
Khadinxc wants to merge 1 commit into
Conversation
Updated role requirements for onboarding Microsoft Sentinel to include additional subscription and resource group conditions.
Contributor
|
@Khadinxc : Thanks for your contribution! The author(s) and reviewer(s) have been notified to review your proposed change. |
Contributor
|
Learn Build status updates of commit 7f1796f: ✅ Validation status: passed
For more details, please refer to the build report. |
Contributor
|
Can you review the proposed changes? Important: When the changes are ready for publication, adding a #label:"aq-pr-triaged" |
prmerger-automator
Bot
added
the
aq-pr-triaged
Contributor
|
@Khadinxc : Thanks for your contribution! The author(s) and reviewer(s) have been notified to review your proposed change. |
Contributor
There was a problem hiding this comment.
Pull request overview
This pull request updates the Microsoft Sentinel onboarding prerequisites in Defender portal documentation to better specify the minimum Azure RBAC scope required for each role option used during onboarding.
Changes:
- Expanded the Scope guidance for the onboarding task to differentiate subscription vs. resource group requirements by role.
- Clarified the role-assignment scope expectations when using the alternative role combination (User Access Administrator + Microsoft Sentinel Contributor).
| |Task |Microsoft Entra or Azure built-in role required |Scope | | ||
| |---------|---------|---------| | ||
| |**Onboard Microsoft Sentinel to the Defender portal**<sup>1</sup>| At least a [Security Administrator](/entra/identity/role-based-access-control/permissions-reference#security-administrator) in Microsoft Entra ID <br><br> [Owner](/azure/role-based-access-control/built-in-roles#owner) (unconditional role assignment)<br> OR <br>[User Access Administrator](/azure/role-based-access-control/built-in-roles#user-access-administrator) and [Microsoft Sentinel Contributor](/azure/role-based-access-control/built-in-roles#microsoft-sentinel-contributor) |Tenant<br><br><br>- Subscription for Owner role| | ||
| |**Onboard Microsoft Sentinel to the Defender portal**<sup>1</sup>| At least a [Security Administrator](/entra/identity/role-based-access-control/permissions-reference#security-administrator) in Microsoft Entra ID <br><br> [Owner](/azure/role-based-access-control/built-in-roles#owner) (unconditional role assignment)<br> OR <br>[User Access Administrator](/azure/role-based-access-control/built-in-roles#user-access-administrator) and [Microsoft Sentinel Contributor](/azure/role-based-access-control/built-in-roles#microsoft-sentinel-contributor) |Tenant<br><br><br>- Subscription for Owner role<br> OR <br>- Subscription for User Access Administrator<br>- Resource Group for Microsoft Sentinel Contributor| |
| |Task |Microsoft Entra or Azure built-in role required |Scope | | ||
| |---------|---------|---------| | ||
| |**Onboard Microsoft Sentinel to the Defender portal**<sup>1</sup>| At least a [Security Administrator](/entra/identity/role-based-access-control/permissions-reference#security-administrator) in Microsoft Entra ID <br><br> [Owner](/azure/role-based-access-control/built-in-roles#owner) (unconditional role assignment)<br> OR <br>[User Access Administrator](/azure/role-based-access-control/built-in-roles#user-access-administrator) and [Microsoft Sentinel Contributor](/azure/role-based-access-control/built-in-roles#microsoft-sentinel-contributor) |Tenant<br><br><br>- Subscription for Owner role| | ||
| |**Onboard Microsoft Sentinel to the Defender portal**<sup>1</sup>| At least a [Security Administrator](/entra/identity/role-based-access-control/permissions-reference#security-administrator) in Microsoft Entra ID <br><br> [Owner](/azure/role-based-access-control/built-in-roles#owner) (unconditional role assignment)<br> OR <br>[User Access Administrator](/azure/role-based-access-control/built-in-roles#user-access-administrator) and [Microsoft Sentinel Contributor](/azure/role-based-access-control/built-in-roles#microsoft-sentinel-contributor) |Tenant<br><br><br>- Subscription for Owner role<br> OR <br>- Subscription for User Access Administrator<br>- Resource Group for Microsoft Sentinel Contributor| |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This pull request updates the onboarding requirements for Microsoft Sentinel in the Defender portal documentation. The main change is a clarification and expansion of the required scope for role assignments, specifying the necessary scopes for each role involved in the onboarding process.
Role assignment scope clarification:
Ownerrole requires a subscription scope, while theUser Access Administratorrequires a subscription scope and theMicrosoft Sentinel Contributorrequires a resource group scope. This clarifies the minimum scope needed for each role during onboarding.Updated role requirements for onboarding Microsoft Sentinel to include additional subscription and resource group conditions.