Configure roles to export data to the new event hub

To stream events from Microsoft 365 Defender to an event hub, you’ll need accounts configured with specific roles.

To add these roles to existing accounts:

1. In Azure Portal, click All resources in the side navigation bar.
2. Click the name of the event hub namespace you created earlier.
3. Click Access control (IAM) in the side menu pane.
   

Add Contributor role

4. Click +Add > Add Role Assignment.
5. Click Contributor.
6. Click the Members tab.
7. Click +Select members.
8. Select the account that can log in to Microsoft 365 Defender.
9. Click Review + assign.
10. Click Review + assign.

Add Reader role

11. Click +Add > Add Role Assignment.
12. Click Reader.
13. Click the Members tab.
14. Click +Select members.
15. Select the account that is assigned as a Service Principal and can log in to the Microsoft Entra ID application.
16. Click Review + assign.
17. Click Review + assign.

Add Azure Event Hub Data Receiver role

18. Click +Add > Add Role Assignment.
19. Click Azure Event Hub Data Receiver.
20. Click the Members tab.
21. Click +Select members.
22. Select the previous account, that is assigned as a Service Principal and can log in to the Microsoft Entra ID application.
23. Click Review + assign.
24. Click Review + assign.