Search filters this STIG's checks locally. Separate terms must all match (use quotes for an exact phrase). A search you ran on the Search page carries over here.
Assessment Title
Rule Text
Roles for use with Microsoft Defender for Endpoint (MDE) must be configured within Entra ID.
Description
Discussion Text
Application management functionality includes functions necessary for administration and requires privileged user access. Allowing nonprivileged users to access application management functionality capabilities increases the risk that nonprivileged users may obtain elevated privileges.
Using role-based access control (RBAC), roles and groups can be created within the security operations team to grant appropriate access to the MDE portal. Based on the roles and groups created, the capability will exist to have fine-grained control over what users with access to the portal can view and do.
Creation of Entra ID roles is a prerequisite to configuring RBAC within the MDE portal itself.
Defender for Endpoint RBAC is designed to support a role-based model and provides granular control over what roles can view, devices they can access, and actions they can take. The RBAC framework is centered around the following controls:
- Control who can take specific action.
- Create custom roles and control what Defender for Endpoint capabilities they can access with granularity.
- Control who can view information on specific device group or groups.
Satisfies: SRG-APP-000211, SRG-APP-000267
Using role-based access control (RBAC), roles and groups can be created within the security operations team to grant appropriate access to the MDE portal. Based on the roles and groups created, the capability will exist to have fine-grained control over what users with access to the portal can view and do.
Creation of Entra ID roles is a prerequisite to configuring RBAC within the MDE portal itself.
Defender for Endpoint RBAC is designed to support a role-based model and provides granular control over what roles can view, devices they can access, and actions they can take. The RBAC framework is centered around the following controls:
- Control who can take specific action.
- Create custom roles and control what Defender for Endpoint capabilities they can access with granularity.
- Control who can view information on specific device group or groups.
Satisfies: SRG-APP-000211, SRG-APP-000267
New to STIG checklists? Read What is a STIG checklist? and CKL vs CKLB.