Microsoft will switch Defender and Sentinel to unified RBAC from December

Microsoft will switch Defender and Sentinel to unified RBAC from December

3 November 2026: Microsoft is going to turn on Defender role-based access control (Defender RBAC) automatically in tenants that have not done so, starting in December 2026. Message Center post MC1537494, published on 3 November and marked as a major change needing admin action by 2 December, says the model will become the single way to manage access to both Microsoft Defender and Microsoft Sentinel in the Defender portal.

Not yet independently verified. We read the public archive copy of Message Center posts MC1537494 and MC1537406, not a tenant's own Message Center. Each tenant's real dates appear only in the banner in its Defender portal. We will update this when it can be confirmed, and remove this note.

A 30-day review window, then activation

The rollout has two steps. First a banner appears in the Defender portal and the tenant's existing roles are imported into the new model. That starts a notification period of about 30 days, during which the import has no effect on who can do what. Then Defender RBAC is activated for the workloads named in the banner. Microsoft gives the global schedule as beginning in early December 2026 and finishing by late January 2027, so two tenants can be on very different dates.

Admins can edit imported assignments at any time, even before activation, and can re-run the import by hand. The post names one concrete step: open Permissions and then Roles in the Defender portal, check that each user has the role and scope expected, and update runbooks.

What changes and what stays put

After activation, authorisation for the Defender and Sentinel portal experiences defaults to Defender RBAC roles, and the legacy assignments are no longer needed to operate them. This covers Defender for Office 365 Plan 2, whether bought alone or inside Microsoft 365 E5, where Email and Collaboration and Exchange Online permissions stop being required for the portal. The Sentinel workspace roles of Reader, Responder and Contributor are enabled in Defender RBAC automatically.

Left alone: Microsoft Purview, Exchange Online, Entra directory roles, Privileged Identity Management and Azure resource permissions not tied to Sentinel. Global Administrator, Security Administrator, Security Operator and Security Reader still open the portal, and map to Defender RBAC permissions. Delegated access through B2B, GDAP and multi-tenant management is unchanged, and its role assignments are included in the import. Anyone setting roles through scripts must move to the new Defender RBAC API.

The way back

Microsoft offers a self-service opt-out only after activation: the workload settings control in Defender RBAC reverts to the legacy system at once. A tenant that wants to stay on the old model for audit reasons therefore cannot decide in advance, and must be watching the portal when the banner arrives. The post also says the new model is a prerequisite for newly introduced offerings, naming one called Perception, and it advises checking imported assignments against access-governance and change-management rules before activation.

A smaller retirement in the same batch

MC1537406, published the same day, says "Describe it to design it" in Power Automate reaches end of support on 30 November 2026. Makers will no longer be able to create new cloud flows with it; existing flows are not deleted or moved, and the visual designer and templates still work. Microsoft points makers who want to build flows from a description to the Power Automate plugin in an organisation-approved coding assistant.

Related on TrustList:

• Outlook attachments now enforce Conditional Access: non-compliant users blocked from downloading, previewing and uploading (MC1472591)

Sources

• Microsoft 365 Message Center Archive: MC1537494, your tenant will be auto enabled for the new Microsoft Defender RBAC model, 3 November 2026
• Microsoft 365 Message Center Archive: MC1537406, Power Automate end of support for Describe it to design it, 3 November 2026