Microsoft Defender for Cloud Apps: Permission changes for select App Governance Entra roles

🚨 The Signal: Microsoft Defender for Cloud Apps (MDCAS) App Governance permissions are changing for specific Entra roles due to Unified RBAC integration. Cloud App Security Admins gain full App Governance access, while Compliance Admins and Compliance Data Admins lose management capabilities.

The Impact

Security and compliance teams are affected, with a risk of misconfigured App Governance policies if role changes are not managed.

• Cloud App Security Admins gain new App Governance policy management permissions.
• Compliance Admins lose App Governance policy management and enablement permissions.
• Compliance Data Admins lose App Governance enablement permissions.
• Custom Defender XDR Unified RBAC roles may require review to ensure correct App Governance access.

The Action

1. Identify all users currently assigned the 'Cloud App Security Administrator', 'Compliance Administrator', and 'Compliance Data Administrator' Entra roles.
2. Review current App Governance policy management responsibilities for these users.
3. Determine if users with 'Compliance Administrator' or 'Compliance Data Administrator' roles still require App Governance management capabilities.
4. If continued App Governance management is needed for 'Compliance Administrator' or 'Compliance Data Administrator' users, assign them the 'Cloud App Security Administrator' role or a custom Defender XDR Unified RBAC role with appropriate permissions.
5. Verify App Governance policy management and settings access for all affected administrators post-rollout.

Domain: Defender · Impact: high · Workload: Microsoft Defender · Essential Eight: Restrict Administrative Privileges · ISM: ISM-0445, ISM-1175, ISM-1380, ISM-1507, ISM-1508, ISM-1509, ISM-1647, ISM-1648, ISM-1650, ISM-1686, ISM-1688, ISM-1689, ISM-1883, ISM-1897, ISM-1898