Search filters this STIG's checks locally. Separate terms must all match (use quotes for an exact phrase). A search you ran on the Search page carries over here.
Assessment Title
Rule Text
Microsoft Defender for Endpoint (MDE) must be configured for a least privilege model by implementing Unified Role-Based Access Control (RBAC).
Description
Discussion Text
When first accessing the Microsoft Defender portal, either full access or read only access is granted. Full access rights are granted to users with the Security Administrator (or equivalent) role in Microsoft Entra ID. Read only access is granted to users with a Security Reader (or equivalent) role in Microsoft Entra ID.
The permission tiers available to assign to custom roles are as follows:
View data:
- Security Operations - View all security operations data in the portal.
- Defender Vulnerability Management - View Defender Vulnerability Management data in the portal.
Active remediation actions:
- Security Operations - Take response actions, approve or dismiss pending remediation actions, manage allowed/blocked lists for automation and indicators.
- Defender Vulnerability Management.
- Exception handling - Create new exceptions and manage active exceptions.
Defender Vulnerability Management - Remediation handling:
- Submit new remediation requests, create tickets, and manage existing remediation activities.
Defender Vulnerability Management - Application handling:
- Apply immediate mitigation actions by blocking vulnerable applications, as part of the remediation activity and manage the blocked apps and perform unblock actions.
Security baselines:
- Defender Vulnerability Management.
- Manage security baselines assessment profiles.
- Create and manage profiles so users can assess if devices comply to security industry baselines.
Alerts investigation:
- Manage alerts, initiate automated investigations, run scans, collect investigation packages, manage device tags, and download only portable executable (PE) files.
Manage portal system settings:
- Configure storage settings, SIEM, and threat intel API settings (applies globally), advanced settings, automated file uploads, roles, and device groups.
Satisfies: SRG-APP-000211, SRG-APP-000267
The permission tiers available to assign to custom roles are as follows:
View data:
- Security Operations - View all security operations data in the portal.
- Defender Vulnerability Management - View Defender Vulnerability Management data in the portal.
Active remediation actions:
- Security Operations - Take response actions, approve or dismiss pending remediation actions, manage allowed/blocked lists for automation and indicators.
- Defender Vulnerability Management.
- Exception handling - Create new exceptions and manage active exceptions.
Defender Vulnerability Management - Remediation handling:
- Submit new remediation requests, create tickets, and manage existing remediation activities.
Defender Vulnerability Management - Application handling:
- Apply immediate mitigation actions by blocking vulnerable applications, as part of the remediation activity and manage the blocked apps and perform unblock actions.
Security baselines:
- Defender Vulnerability Management.
- Manage security baselines assessment profiles.
- Create and manage profiles so users can assess if devices comply to security industry baselines.
Alerts investigation:
- Manage alerts, initiate automated investigations, run scans, collect investigation packages, manage device tags, and download only portable executable (PE) files.
Manage portal system settings:
- Configure storage settings, SIEM, and threat intel API settings (applies globally), advanced settings, automated file uploads, roles, and device groups.
Satisfies: SRG-APP-000211, SRG-APP-000267
New to STIG checklists? Read What is a STIG checklist? and CKL vs CKLB.