You have a Microsoft 365 subscription with Defender for Endpoint, and you've enabled Microsoft Defender XDR unified RBAC for Endpoints & Vulnerability Management. The requirement is that User1 should be able to configure alerts (i.e. set up rules that send email notifications) such that emails go to Group1, and you want to follow least privilege-that is, grant the minimal permission necessary for that capability.
Microsoft's official documentation states:
"Only users with 'Manage security settings' permissions can configure email notifications." Microsoft Learn Thus, in the Defender XDR RBAC model, the permission that allows a user to create or modify email notification alert rules is tied to Manage security settings (also referred to as core security settings in some documentation) .
Furthermore, the "Alert policies in the Microsoft Defender portal" article indicates that to create or edit alert policies (i.e. rules that govern how alerts behave and who they notify), you need the Manage Alerts role or equivalent permissions. However, in the unified RBAC model, managing alert policies overlaps with the broader "security settings" capability. Microsoft Learn Therefore:
* Granting Manage security settings gives exactly the ability required to configure email notification rules for alerts (including targeting the Microsoft 365 group) without giving broader investigative or remediation privileges.
* Other permissions-e.g., "Alerts investigation" (allows investigating alerts), "Defender Vulnerability Management - Remediation handling" (for handling remediation tasks), or "Live response capabilities:
Basic" (for remote response actions)-do not cover alert notification configuration.
Hence the correct, least-privilege RBAC permission to assign to User1 is Manage security settings.