P1 Azure License - Granting Red Canary analysts read-only access to your Microsoft Defender console

Red Canary MSSP Access Instructions for Azure P1 will provide Red Canary organization members with direct access to your Microsoft Defender Security Center console.  RBAC Permissions are fully configurable and access is audited via Microsoft Azure Active Directory. 

These instructions are intended for customers who use Microsoft Azure P1 type licenses, which does not allow access to the Identity Governance features of Azure. If you have an E5/A5 license, please see this help article to get started.

Granting Red Canary Access consists of two steps: 

1. Preparing groups and bulk uploading users to Azure
2. Enabling Role Based Access Controls (RBAC) in Microsoft Defender ATP

Before beginning the MSSP Access  process for Azure P1, you will need to have access to an account with Security Administrator privileges within your Azure Organization. 

Preparing Microsoft Azure group for RBAC and bulk uploading Red Canary users to Azure.

1. Navigate to https://portal.azure.com and log in with your Global or Security Administrator Microsoft account. 
2. Expand the navigation pane on the left hand side of the page and select Azure Active Directory. 
3. Select Groups. 
4. Click “New Group” 
5. Fill in the group parameters with the following: 
• Group Type: Security
• Group Name: Red Canary
• Group Description: Red Canary Access Group
• Azure AD roles can be assigned to the group (Preview): Yes
• Membership Type: Assigned
• Owners: No owners selected
• Members: No members selected
6. Click “Create”
7. Navigate to “Users” in Azure Active Directory.
8. Click “Bulk Operations” from the top menu. 
9. Click “Bulk Invite” from the “Bulk Operations” menu.
10. Click the folder icon labeled “Upload your csv file” and browse to the file titled “BulkUserInvite_RedCanaryUsers.csv” provided by your Red Canary account rep. 
11. Click Submit. 
12. Navigate to Azure Active Directory Groups. 
13. Select the Red Canary group. 
14. Select “Bulk Operations” from the top menu. 
15. Select “Import Members” 
16. Click the folder icon labeled “Upload your csv file” and browse to the file titled “BulkMembers_RedCanary.csv” provided by your Red Canary account rep.
17. Click Submit.  

Enabling Role Based Access Controls in Microsoft Defender for Endpoint.

1. Navigate to https://securitycenter.windows.com and log in with your Global Administrator Microsoft account. 
   1. Click on Settings
   2. Click on Roles
   3. Click Add Item
2. Configure permissions for the new role. 
   1. Role Name: Red Canary
   2. Description: Red Canary Access Role
   3. Check the following Permissions boxes only. 
      1. View Data
         • Security Operations
         • Threat and Vulnerability Management
      2. Active Remediation Actions
         • Security Operations
      3. Alerts Investigation
      4. Live Response Capabilities
         • Basic
   4. Click on “Assigned user groups” 
   5. Select the group named Red Canary
   6. Click Add Selected Groups
   7. Click Save