Defender XDR unified RBAC: workload activation, custom roles and portal access errors

Microsoft Defender unified role-based access control (often called Defender XDR unified RBAC or URBAC) replaces the separate permission models of Defender for Endpoint, Defender for Identity, Defender for Office 365 and other workloads with one set of custom roles. Most "I can't see it" tickets after a change come down to three questions: which model is each workload using, which permissions and data sources does the user's role grant, and which device groups can they see? In this post I'll show how to answer each one and fix the access.

Symptoms#

• A user signs in to the Microsoft Defender portal and gets No subscriptions found or You are not authorized to access the portal.
• The dashboard or some sections show Data currently isn't available.
• A custom role was created and assigned, but the user's access hasn't changed.
• An analyst sees incidents but not all devices, or Defender for Endpoint alerts but no email or identity alerts.
• A Security Reader lost access to device pages after someone turned on roles.
• Saving a setting fails with You don't have permission to perform this action. (reported by admins; the browser's developer tools then show a 403 response naming the missing permission).

Why it happens#

• The workload isn't active in unified RBAC. You can create and import roles at any time, but the portal keeps respecting the old model for a workload until you activate it. Once active, that workload's access is controlled entirely by unified RBAC roles.
• The role grants the wrong scope. A role has permissions (grouped as Security operations, Security posture, Authorization and settings, and the preview Data operations group) plus assignments that name the users and the data sources. Read access to the Defender for Endpoint data source alone doesn't show Defender for Office 365 or Defender for Identity alerts.
• Device groups still scope devices. Defender for Endpoint device groups decide which devices a user can see and act on, alongside the role.
• Legacy Defender for Endpoint roles. In the old model, turning on roles removes access for read-only users such as Security Readers until they're assigned to a role, and it can't be undone.
• It isn't a Defender permission at all. No license in the Microsoft Entra tenant you signed in to causes "No subscriptions found"; DLP and Insider Risk pages use Microsoft Purview permissions; Exchange Online and Security & Compliance PowerShell keep using Exchange Online and Email & collaboration roles; and "Data currently isn't available" can be a browser that blocks the portal's subdomains.

How to fix it#

1. Check each workload's model#

As at least a Security Administrator in Microsoft Entra ID, go to System › Permissions, and under Microsoft Defender XDR select Roles, then Workload settings (the same page is under System › Settings › Microsoft Defender XDR › Permissions and roles). Note which workloads show as active. Starting in 2025, unified RBAC is the default for new Defender for Endpoint and Defender for Identity tenants, and Microsoft extended that to new Defender for Office 365 Plan 2 organizations from July 2026. Older tenants often run a mix. Defender for Cloud is active by default, and Exposure Management permissions take effect as soon as a role includes them.

2. Map the user's effective access#

Entra roles keep working after activation: Security Administrators keep their rights. Check the user's directory roles in the Microsoft Entra admin center (Users › the user › Assigned roles), then list the custom roles on the Roles page and open each assignment to see whether the user, or a security group they belong to, is included, and for which data sources.

3. Bring existing roles across before activating#

Use the import option on the Roles page to copy existing roles from the individual models, or create new ones (step 4), then confirm the assignments. Only then activate the workload: toggle it on in Workload settings and confirm. To activate Exchange Online permissions, the Defender for Office 365 workload must already be active. If something goes badly wrong, turning a workload's toggle off reverts it to the previous model.

4. Create a custom role with the right scope#

1. On Permissions › Microsoft Defender XDR › Roles, select Create custom role and enter a name.
2. Choose the permission groups. For an analyst who only views data, Security operations with Security data basics (read) is the starting point; add response or settings permissions only where needed. Choosing All read-only permissions or All read and manage permissions also picks up permissions Microsoft adds later; a hand-picked list doesn't.
3. Select Add assignment, add Microsoft Entra security groups (not individuals), and select the data sources. Use Include future data sources automatically for roles that should follow new workloads.
4. Review and submit. One role can have several assignments, for example all data sources for the SOC and only Defender for Endpoint for the endpoint team.

5. Fix device visibility#

In the Defender for Endpoint device group settings, check that the user's Entra group has access to the groups that contain the missing devices. Device groups also drive automation levels, as covered in AIR and device groups.

6. Delegate role management without Security Administrator#

Create a role with the Authorization permission under Authorization and settings (all permissions, or read-only) and scope it to all or specific data sources. Users with it can manage roles without a privileged Entra role.

7. Fix what isn't RBAC#

For "No subscriptions found", make sure the Defender license is provisioned in the same Microsoft Entra tenant the user signs in to. For "Data currently isn't available", allow security.windows.com and its subdomains and the portal URLs Microsoft lists. For Purview pages, see Purview roles and role groups.

Verify the fix#

• Sign in as a test member of the group in a private browser window, after giving the change time to apply.
• Check that the expected navigation items, alerts per data source and device count appear, and that a permitted action (assign an alert, run an antivirus scan) succeeds while an unpermitted one is blocked.
• Confirm that Workload settings shows the intended workloads as active and that no sync notification appears on the Permissions page (relevant for Microsoft Sentinel workspaces).

Prevent it next time#

• Design roles around personas (SOC tier 1, endpoint team, email team), assign them to groups, and activate one workload at a time.
• Review custom roles when Microsoft adds permissions, because hand-picked lists don't grow automatically.
• Keep at least one emergency Security Administrator outside the custom-role design.
• Remember the boundaries: Sentinel workspaces also respect Azure RBAC, and Intune has its own model (see Intune RBAC and scope tags).

References#

• Microsoft Defender unified role-based access control (RBAC)
• Activate Microsoft Defender unified role-based access control
• Create custom roles with Microsoft Defender unified RBAC