Before you begin
- An Atlas AVD account with a signed-in user
- A role that grants at least one security permission (otherwise the Security section is hidden)
What lives in the Security section
The Security section can show up to five items, each gated by its own permission:
- Audit: the tenant's audit trail of user actions and infrastructure changes. Admin, Security Admin, Auditor, Billing Viewer, Reports Viewer, and Read Only can open it; the Atlas Ink roles see a view limited to Atlas Ink activity.
- Alerts: Microsoft Defender for Endpoint alerts for your devices.
- Conditional Access: your Microsoft Entra Conditional Access policies. Before you create one, set up break-glass accounts and exclude them (see Exclude Break-Glass Accounts from Conditional Access).
- Group Policy: ADMX administrative templates. Administrators only.
- Threat Protection: device protection status, vulnerabilities, and the CVE catalog, powered by Microsoft Defender for Endpoint.
The whole section is hidden when your role holds none of these permissions, for example Help Desk or Portal User.
Threat Protection at a glance
Threat Protection opens on the Posture tab, with Vulnerabilities and CVE Catalog tabs beside it. Administrators see Refresh Inventory and Install Defender in the page header, and the More actions menu links to security alerts, duplicate devices to offboard, and unprotected devices. Threat Protection needs Microsoft Defender for Endpoint connected for the tenant; until it is, the page says so instead of showing an empty fleet.
How access is decided
Atlas enforces access in three layers: permission (does your role grant it), tier (does your license unlock the feature), and tenant membership (every request is scoped to your tenant). Hiding or disabling something in the browser is only a convenience; the server always makes the final decision.
What Atlas protects
Atlas AVD's security design centers on tenant isolation (a database per tenant), protection of your Azure credentials and secrets (encrypted before they are stored), and an attributable record of administrative actions. The audit trail is always scoped to your own tenant and cannot be pointed at another one.
Security settings outside this section
A few protections live elsewhere: Encryption at Host is a session-host default you set in the setup wizard or Global Settings (see Enable Encryption at Host); roles are assigned under Administration → Tenants → User Administration (see Role-Based Access Control); and device-level controls for remote sessions, such as the consent policy and BitLocker, are on the Atlas Reach page.