What changed in Microsoft Defender for Endpoint STIG V1R2V1R2 changes

Microsoft Defender for Endpoint STIG V1R2 (2026-01-05) replaced V1R1 (2025-07-14): 1 check updated. It has 25 checks, against 25 in V1R1.

V1R2 checklistV1R1 checklist Compare V1R1 and V1R2 in STIG Compare

  • 0 added
  • 0 removed
  • 1 updated

Updated fields: Check text 1Fix text 1

Updated in V1R2 (1)

V-272887CAT IIMicrosoft Defender for Endpoint (MDE) must be configured for a least privilege model by implementing Unified Role-Based Access Control (RBAC).Check text, Fix text

Check text

Access the MDE portal as a user with at least an MDE Administrator or equivalent role: 1. In the navigation pane, select Settings >> EndpointsMicrosoft Defender XDR >> RolesPermissions (underand Permissions)Roles. 2. For each defined role: - Click hethe role to enter the edit role screen. - Verify the Permissions are configured as defined by the authorizing official (AO). - Verify the appropriate user groups are assigned as defined by the AO. - Click "Cancel". If Settings >> EndpointsMicrosoft Defender XDR >> RolesPermissions (underand Permissions)Roles does not display roles as defined by the AO, this is a finding. When selecting each role individually, if the permissions and user groups are not as defined by the AO, this is a finding.

Fix text

Access the MDE portal as a user with at least an MDE Administrator or equivalent role: 1. In the navigation pane, select Settings >>Endpoints Microsoft Defender XDR >> RolesPermissions (underand Permissions)Roles. 2. Select "+Add role". 3. Enter a Role Name, select "Permissions" as defined by the AO, and then click "Next". 4. Select the appropriate group as defined in MSDE-00-000300.

V-272887 in V1R2

How these changes are found

Checks are matched across the two releases by V-number. A check counts as updated when DISA gave it a new rule revision (the r number in its SV-…_rule id) and its title, severity, check text, fix text, discussion, CCIs or other fields changed — the same comparison STIG Compare makes. Added checks are new V-numbers; removed checks are V-numbers V1R2 no longer has.

Comparing other releases, or this one against an older release? Pick any two in STIG Compare.