Defender Unified RBAC Scoped Reader

{
  "properties": {
    "roleName": "Defender Unified RBAC Scoped Reader",
    "type": "BuiltInRole",
    "description": "Defender Unified RBAC Scoped Reader. This role is managed and assigned automatically by the Defender Unified RBAC system. Manual assignment of this role is not recommended, as the Defender Unified RBAC system may modify or remove it at any time based on system requirements.",
    "assignableScopes": [
      "/"
    ],
    "permissions": [
      {
        "actions": [
          "Microsoft.SecurityInsights/*/read",
          "Microsoft.SecurityInsights/dataConnectorsCheckRequirements/action",
          "Microsoft.SecurityInsights/threatIntelligence/indicators/query/action",
          "Microsoft.SecurityInsights/threatIntelligence/queryIndicators/action",
          "Microsoft.OperationalInsights/workspaces/analytics/query/action",
          "Microsoft.OperationalInsights/workspaces/*/read",
          "Microsoft.OperationalInsights/workspaces/LinkedServices/read",
          "Microsoft.OperationalInsights/workspaces/savedSearches/read",
          "Microsoft.OperationsManagement/solutions/read",
          "Microsoft.OperationalInsights/workspaces/query/read",
          "Microsoft.OperationalInsights/workspaces/query/*/read",
          "Microsoft.OperationalInsights/querypacks/*/read",
          "Microsoft.OperationalInsights/workspaces/dataSources/read",
          "Microsoft.OperationalInsights/workspaces/read"
        ],
        "notActions": [
          "Microsoft.SecurityInsights/ConfidentialWatchlists/*",
          "Microsoft.OperationalInsights/workspaces/query/ConfidentialWatchlist/*",
          "Microsoft.SecurityInsights/alertRules/read"
        ],
        "dataActions": [
          "Microsoft.OperationalInsights/workspaces/tables/data/read"
        ],
        "notDataActions": []
      }
    ],
    "createdOn": "2025-11-25T16:15:47.963Z",
    "updatedOn": "2025-11-25T16:15:47.963Z",
    "createdBy": null,
    "updatedBy": null
  },
  "id": "/providers/Microsoft.Authorization/roleDefinitions/d56b031f-8d90-4376-9231-b5c94fce88ef",
  "type": "Microsoft.Authorization/roleDefinitions",
  "name": "d56b031f-8d90-4376-9231-b5c94fce88ef"
}