Study guide
7.2 Managing Permissions for Defender XDR, Purview & Workloads
Microsoft 365 Administrator Expert MS-102
Track your progress as you read
Finished sections get a check mark.
1 Introduction & Exam Overview
1.1 MS-102 Exam Facts & Blueprint 1.2 Registration, Retake & Renewal 1.3 Study Strategy & Using This Guide
2 Tenant Setup, Domains & Org Settings
2.1 Creating a Microsoft 365 Tenant 2.2 Implementing and Managing Domains 2.3 Configuring Org Settings: Security, Privacy & Profile
3 Service Health, Network & Software Updates
3.1 Monitoring Service Health & Notifications 3.2 Network Connectivity Insights 3.3 Configuring & Monitoring Software Updates
4 Adoption, Usage & Microsoft 365 Backup
4.1 Monitoring Adoption & Usage 4.2 Configuring & Managing Microsoft 365 Backup
5 Users, Contacts, Groups & Shared Mailboxes
5.1 Creating & Managing Users Including External Users 5.2 Creating & Managing Contacts 5.3 Managing Microsoft 365 Groups & Shared Mailboxes
6 Licensing & Bulk User Management
6.1 Managing & Monitoring Microsoft 365 Licenses 6.2 Bulk User Management with Graph & Entra PowerShell
7 Roles, Admin Units & Privileged Identity Management
7.1 Implementing & Managing Roles in M365 & Entra ID 7.2 Managing Permissions for Defender XDR, Purview & Workloads 7.3 Managing Delegation with Administrative Units 7.4 Managing Entra ID Roles in PIM
8 Identity Synchronization with Entra Connect
8.1 Preparing for Identity Synchronization & IdFix 8.2 Directory Sync with Entra Connect Sync & Cloud Sync 8.3 Monitoring Sync with Entra Connect Health 8.4 Troubleshooting Synchronization
9 Authentication, SSPR & Password Protection
9.1 Implementing & Managing Authentication Methods 9.2 Self-Service Password Reset (SSPR) 9.3 Microsoft Entra Password Protection 9.4 Investigating & Resolving Authentication Issues
10 Identity Protection, Conditional Access & MFA
10.1 Planning for Identity Protection 10.2 Implementing Entra Identity Protection 10.3 Planning & Implementing Conditional Access Policies 10.4 Managing MFA with Conditional Access
11 Defender XDR Posture, Incidents & Threat Intelligence
11.1 Security Exposure Management & Secure Score 11.2 Incidents, Alerts & Advanced Hunting 11.3 Reviewing Defender XDR Reports 11.4 Defender Threat Intelligence
12 Defender for Office 365: Policies, Alerts & Investigation
12.1 Threat Policies & Rules in Defender for Office 365 12.2 Configuring Alert Policies 12.3 Investigating & Responding to Email Threats
13 Attack Simulation & Restricted Entities
13.1 Managing Attack Simulations & Training 13.2 Managing Restricted Entities & Blocked Users
14 Defender for Endpoint
14.1 Onboarding Devices to Defender for Endpoint 14.2 Configuring Endpoint Settings 14.3 Defender Vulnerability Management Dashboard
15 Defender for Cloud Apps
15.1 Configuring the App Connector for Microsoft 365 15.2 Defender for Cloud Apps Policies & Alerts 15.3 Interpreting the Activity Log 15.4 Cloud App Discovery
16 Purview Information Protection & Data Lifecycle
16.1 Sensitive Information Types 16.2 Retention Labels & Policies 16.3 Sensitivity Labels & Policies 16.4 Monitoring Label Usage: Content & Activity Explorer
17 Purview Data Loss Prevention
17.1 DLP Policies for Microsoft 365 Workloads 17.2 Configuring Endpoint DLP 17.3 Reviewing & Responding to DLP Alerts, Events & Reports
18 Final Review & Exam Strategy
18.1 Exam-Day Strategy & Question Handling 18.2 Final Review Checklist & Next Steps
7.2 Managing Permissions for Defender XDR, Purview & Workloads
Key Takeaways Explain This Topic AI
Microsoft Defender XDR relies on Entra ID security roles (Security Administrator, Security Operator, Security Reader) plus custom Defender RBAC roles configured in the Defender portal
Microsoft Purview compliance portal uses role groups (Compliance Administrator, eDiscovery Manager, Information Protection) that bundle Entra roles plus workload-specific permissions
eDiscovery Administrator sees all eDiscovery cases tenant-wide; eDiscovery Manager sees only cases they are a member of
Exchange Online uses RBAC role groups as its primary permission container — Organization Management, Compliance Management, Discovery Management, Records Management, View-Only Organization Management
Microsoft is converging Entra roles and workload roles into a unified RBAC model manageable from the Defender and Purview portals
Last updated: August 2026
Managing Permissions for Microsoft Defender XDR, Purview & Workloads
Microsoft 365 workloads each expose their own permission model. MS-102 expects you to know which model each workload uses, where the role groups live, and how Microsoft is converging these into a unified RBAC experience accessible from the Defender and Purview portals.
Per-Workload Permission Models
Workload Permissions Model Where Managed
Microsoft Defender XDR Entra ID security roles + custom Defender RBAC roles Microsoft Defender portal → Settings → Permissions
Microsoft Purview (compliance) Role groups bundling Entra roles + permissions Purview compliance portal → Permissions
Exchange Online RBAC role groups Exchange admin center → Roles
SharePoint Online SharePoint Administrator (Entra) + site-level permission levels SharePoint admin center + site permissions
- Microsoft Teams Entra role-based (Teams Administrator family) Teams admin center + Entra admin center
- Microsoft Defender XDR Permissions
Microsoft Defender XDR primarily relies on Entra ID roles for top-level access. The built-in roles most commonly assigned are Security Administrator , Security Operator , and Security Reader . Security Administrator can configure policies across Defender for Endpoint, Defender for Office 365, Defender for Identity, and Defender for Cloud Apps; Security Operator can respond to active incidents and take approved remediation actions; Security Reader has read-only visibility into alerts, incidents, and recommendations.
For finer-grained control, Defender XDR supports custom RBAC roles configured directly in the Microsoft Defender portal under Settings → Permissions → Endpoints → Roles . A custom Defender role can grant, for example, "live response" capability without granting full Security Administrator. These custom roles are separate from Entra custom roles and are scoped to the Defender XDR data plane (device groups are one common scoping mechanism).
Microsoft Sentinel, when used alongside Defender XDR, has its own Entra roles — Sentinel Contributor , Sentinel Reader , and Sentinel Responder — plus resource-scope RBAC at the Log Analytics workspace level.
Microsoft Purview Compliance Portal Permissions
The Purview compliance portal uses role groups that bundle Entra roles and workload-specific permissions together. You cannot assign a single Entra role and get all Purview capability; instead you assign the appropriate role group, and the role group carries the underlying permissions.
- Role Group Purpose
- Compliance Administrator Configure and manage compliance policies, alerts
- Compliance Data Administrator Manage data classification and retention at a broader scope
- eDiscovery Manager Access only the eDiscovery cases the manager is a member of
- eDiscovery Administrator All eDiscovery cases tenant-wide (privileged)
- Information Protection Sensitivity labels, DLP, auto-labeling
- Content Explorer Content Viewer View classified content in Content Explorer
- Records Management Retention labels, disposition reviews
Most Purview role groups also require the user to hold a corresponding Entra role (often Compliance Administrator or Security Administrator) for full functionality — the role group alone is sometimes not sufficient for every workload action.
Exchange Online RBAC
Exchange Online uses RBAC role groups as its primary permission container. A role group contains one or more management roles , each of which contains cmdlets and scope. Notable role groups:
Organization Management — full Exchange management (high privilege; the Exchange equivalent of Global Admin for the workload).
Compliance Management — configure compliance features in Exchange (journal rules, retention, DLP transport rules).
Discovery Management — perform mailbox searches and in-place eDiscovery.
Records Management — manage retention tags, retention policies, and message classifications.
View-Only Organization Management — read-only Exchange configuration; useful for auditors and monitoring tools.
Exchange role group membership can be modified in the Exchange admin center or with the Add-RoleGroupMember cmdlet.
Unified RBAC
Microsoft is converging Entra ID roles and Microsoft 365 workload roles into a unified RBAC model . From the Microsoft Defender portal and the Purview compliance portal you can now manage many role assignments in one place, and the Entra admin center's Role management experience increasingly surfaces workload role groups alongside Entra roles. The practical impact: an admin can grant a user security-operations access across Defender XDR, Purview, and Sentinel from a single role-group assignment rather than three separate steps in three portals.
The MS-102 exam expects you to recognize that role groups are the unit of delegation for Purview and Exchange, while Entra roles (built-in or custom) remain the unit for identity-level and Defender XDR top-level access.
Practical Delegation Examples
A SOC analyst who needs to triage incidents but not configure policies should be granted Security Reader (read-only across Defender XDR) or a custom Defender RBAC role limited to "active remediation actions." A compliance officer who needs to create retention policies but not eDiscovery holds should be granted the Records Management or Information Protection role group in Purview — not Compliance Administrator, which is broader. An auditor who needs to see Exchange configuration without changing it gets View-Only Organization Management in Exchange, not Organization Management.